CVE-2026-85063: CSV header triggers prototype

CISO Take

csv-parse, the CSV parsing engine behind node-csv, has a prototype pollution flaw that triggers when the columns and group_columns_by_name options are enabled and a CSV file contains a duplicate __proto__ header: the parser assigns an attacker-controlled array to the record's prototype instead of treating it as ordinary data. There is no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or scanner template yet, so this is not an imminent mass-exploitation risk, but the package sits squarely in AI/ML data-ingestion paths where teams import third-party CSVs into training sets, feature stores, or RAG corpora with limited input scrutiny. The real danger for a CISO isn't crashing the parser — it's that the polluted values are hidden from JSON serialization and can silently distort property enumeration or type checks, which is exactly the kind of stealthy state corruption that evades routine data-quality review. Any product feature that lets a customer, partner, or automated agent upload a CSV to feed a downstream pipeline is a candidate exposure. Patch csv-parse to 7.0.2 or later now, and until then reject headers named __proto__/constructor/prototype at the ingestion boundary.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Overall risk is LOW-to-MODERATE and mostly theoretical at this stage: no CVSS/EPSS scoring exists, it is not in CISA KEV, no public PoC or Nuclei template has surfaced, and the tracked package risk score is 0/100. Exploitability requires an application to (a) use csv-parse with the non-default columns + group_columns_by_name options and (b) accept attacker-influenced CSV input. Impact is contained to logic/data-integrity corruption (prototype pollution affecting enumeration, type checks, and serialization) rather than direct remote code execution, though severity ultimately depends on how the consuming application trusts the shape of parsed records. Exposure is elevated for any product that accepts user- or partner-supplied CSV uploads as part of an automated data or ML pipeline.

How does the attack unfold?

Crafted CSV submission

Attacker submits or supplies a CSV file containing a duplicate __proto__ column header to a service that ingests CSV data for an AI/ML pipeline.

AML.T0010.002

Parser exploitation

csv-parse, configured with columns and group_columns_by_name, treats the duplicate __proto__ header as an existing property and assigns the attacker's array to it, replacing the record object's prototype.

Silent logic/data corruption

The injected values are hidden from JSON serialization and alter property enumeration and type checks, potentially bypassing validation, allow-listing, or permission logic that trusts the parsed record's shape.

Downstream integrity impact

Corrupted or attacker-influenced records propagate into training data, feature stores, or RAG corpora without detection by standard JSON-based auditing, degrading data integrity or enabling logic bypass in the consuming application.

AML.T0020

Crafted CSV submission

Attacker submits or supplies a CSV file containing a duplicate __proto__ column header to a service that ingests CSV data for an AI/ML pipeline.

AML.T0010.002

Parser exploitation

csv-parse, configured with columns and group_columns_by_name, treats the duplicate __proto__ header as an existing property and assigns the attacker's array to it, replacing the record object's prototype.

Silent logic/data corruption

The injected values are hidden from JSON serialization and alter property enumeration and type checks, potentially bypassing validation, allow-listing, or permission logic that trusts the parsed record's shape.

Downstream integrity impact

Corrupted or attacker-influenced records propagate into training data, feature stores, or RAG corpora without detection by standard JSON-based auditing, degrading data integrity or enabling logic bypass in the consuming application.

AML.T0020

How severe is it?

CVSS 3.1

N/A

EPSS

0.6%

chance of exploitation in 30 days

Higher than 47% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

1) Upgrade csv-parse (node-csv) to version 7.0.2 or later immediately — this is a straightforward dependency bump with no behavioral trade-offs described in the advisory. 2) If an immediate upgrade isn't possible, avoid combining the columns and group_columns_by_name options on untrusted CSV input, or pre-validate/strip any header literally named __proto__, constructor, or prototype before parsing. 3) Run Node.js with --disable-proto=throw (or equivalent hardening) in services that parse third-party CSV files, so any prototype manipulation attempt fails loudly instead of silently. 4) Add SCA/dependency scanning coverage for node-csv/csv-parse versions across data-ingestion and ML pipeline services, since this package is easy to overlook in dependency audits focused on ML-specific libraries. 5) For detection, audit logs/tests of CSV ingestion jobs for headers containing __proto__ or unexpected duplicate column names, and review any application logic that trusts object shape/enumeration of parsed CSV rows for security-relevant decisions.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply ChainAuth BypassTraining DataRAGAML.T0010.002- Data AML.T0020- Poison Training Data

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 10-Data and data governance

ISO 42001

A.7 (Data for AI systems)-Data quality and integrity controls

NIST AI RMF

MAP-2.3-Data integrity and provenance

Frequently Asked Questions

What is CVE-2026-85063?

csv-parse, the CSV parsing engine behind node-csv, has a prototype pollution flaw that triggers when the columns and group_columns_by_name options are enabled and a CSV file contains a duplicate __proto__ header: the parser assigns an attacker-controlled array to the record's prototype instead of treating it as ordinary data. There is no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or scanner template yet, so this is not an imminent mass-exploitation risk, but the package sits squarely in AI/ML data-ingestion paths where teams import third-party CSVs into training sets, feature stores, or RAG corpora with limited input scrutiny. The real danger for a CISO isn't crashing the parser — it's that the polluted values are hidden from JSON serialization and can silently distort property enumeration or type checks, which is exactly the kind of stealthy state corruption that evades routine data-quality review. Any product feature that lets a customer, partner, or automated agent upload a CSV to feed a downstream pipeline is a candidate exposure. Patch csv-parse to 7.0.2 or later now, and until then reject headers named __proto__/constructor/prototype at the ingestion boundary.

Is CVE-2026-85063 actively exploited?

No confirmed active exploitation of CVE-2026-85063 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-85063?

1) Upgrade csv-parse (node-csv) to version 7.0.2 or later immediately — this is a straightforward dependency bump with no behavioral trade-offs described in the advisory. 2) If an immediate upgrade isn't possible, avoid combining the columns and group_columns_by_name options on untrusted CSV input, or pre-validate/strip any header literally named __proto__, constructor, or prototype before parsing. 3) Run Node.js with --disable-proto=throw (or equivalent hardening) in services that parse third-party CSV files, so any prototype manipulation attempt fails loudly instead of silently. 4) Add SCA/dependency scanning coverage for node-csv/csv-parse versions across data-ingestion and ML pipeline services, since this package is easy to overlook in dependency audits focused on ML-specific libraries. 5) For detection, audit logs/tests of CSV ingestion jobs for headers containing __proto__ or unexpected duplicate column names, and review any application logic that trusts object shape/enumeration of parsed CSV rows for security-relevant decisions.

What systems are affected by CVE-2026-85063?

This vulnerability affects the following AI/ML architecture patterns: training data pipelines, ETL / data ingestion pipelines, feature stores, RAG document ingestion (CSV corpora), batch data labeling pipelines.

What is the CVSS score for CVE-2026-85063?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

training data pipelinesETL / data ingestion pipelinesfeature storesRAG document ingestion (CSV corpora)batch data labeling pipelines

MITRE ATLAS Techniques

AML.T0010.002Data

AML.T0020Poison Training Data

Compliance Controls Affected

EU AI Act: Article 10

ISO 42001: A.7 (Data for AI systems)

NIST AI RMF: MAP-2.3

What are the technical details?

Original Advisory

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and group_columns_by_name options enabled treats a duplicate __proto__ header as an existing property in packages/csv-parse/lib/api/index.js, assigns an attacker-controlled array through obj['__proto__'], and replaces the parsed record object's prototype. A malicious CSV header can therefore inject inherited array values into the returned record, hide those inherited values from JSON serialization, and affect property enumeration and type or shape checks in applications that process the record. This issue is fixed in version 7.0.2.

Exploitation Scenario

An attacker with the ability to submit a CSV file to a product feature that feeds an AI/ML pipeline — e.g., a customer-facing 'bulk import training labels', 'upload reference dataset', or 'ingest CSV documents into RAG corpus' endpoint — crafts a file with a duplicate __proto__ column header. The backend service parses it with csv-parse using columns and group_columns_by_name enabled (a common combination for named-column CSV ingestion), causing the parser to replace the prototype of every resulting record object with the attacker's array values. If any downstream logic in the ingestion pipeline uses property presence, type checks, or JSON serialization to validate or filter incoming rows (for instance, checking a 'role' or 'is_verified' style field, or feeding the object into a templating/config layer), the attacker's injected values can influence that logic while remaining invisible to naive JSON-based logging or auditing — enabling quiet data-integrity corruption or downstream logic bypass rather than an obvious crash.

Weaknesses (CWE)

CWE-1321Improperly Controlled Modification of Object Prototype AttributesPrimary CWE-1321Improperly Controlled Modification of Object Prototype Attributes

CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

[Implementation] By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
[Architecture and Design] By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.

Source: MITRE CWE corpus.