Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦 npm
Not in CISA KEV

GHSA-8cw4-87c7-c6xx

Fix: adaltas/node-csv#497

GHSA-8cw4-87c7-c6xx is a CWE-1321 vulnerability in csv-parse. O3 Security confirms whether GHSA-8cw4-87c7-c6xx is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

node-csv: Prototype replacement still reachable via columns path

Also known asCVE-2026-85063
Published
Sep 8, 2026
Updated
Sep 8, 2026
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Sep 8, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.

Exploitation and automatability from CISA’s SSVC triage for GHSA-8cw4-87c7-c6xx.

Real-World Exposure

1 pkg affected
📦csv-parse

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects npm packages — download data is not available via public APIs for these ecosystems.

Description

Impact

With columns: true and group_columns_by_name: true, a duplicated proto header causes the duplicate-column branch to assign an array to obj['proto'], invoking the proto setter and replacing the parsed record object's prototype with attacker-controlled data. Fixed in 7.0.2 (Object.hasOwn duplicate check + Object.defineProperty assignment).

Patches

The problem been patched.

Workarounds

Disable usage of both the columns and group_columns_by_name options.

References

issue #496, PR #497

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npmcsv-parseall versions7.0.2

Detection & mitigation playbook

Open-source dependency
  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for csv-parse. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

  2. Fix

    Update csv-parse to 7.0.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-8cw4-87c7-c6xx is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 pinpoints whether GHSA-8cw4-87c7-c6xx is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-8cw4-87c7-c6xx. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Impact With columns: true and group_columns_by_name: true, a duplicated __proto__ header causes the duplicate-column branch to assign an array to obj['__proto__'], invoking the __proto__ setter and replacing the parsed record object's prototype with attacker-controlled data. Fixed in 7.0.2 (Object.hasOwn duplicate check + Object.defineProperty assignment). ### Patches The problem been patched. ### Workarounds Disable usage of both the columns and group_columns_by_name options. ### References issue #496, PR #497
O3 Security · Impact-Aware SCA

Is GHSA-8cw4-87c7-c6xx in your dependencies?

O3 detects GHSA-8cw4-87c7-c6xx across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

GHSA-8cw4-87c7-c6xx: csv-parse | O3 Security