{"action":"Upgrade json-2-csv to 5.5.11 or later.","affected":[{"fixed":"5.5.11","introduced":"3.15.0"}],"component":"json-2-csv","cve_ids":["CVE-2026-9673"],"ecosystem":"npm","epss":0.00166,"exploited":false,"fixed_versions":["5.5.11"],"ghsa_id":"GHSA-g27c-q7cp-mhx6","id":"tcs_01M5KFPN81PY32TM07J9GW7AHN","modified_at":"2026-09-10T03:50:46.850101110Z","published_at":"2026-05-28T06:31:09Z","references":["https://osv.dev/vulnerability/GHSA-g27c-q7cp-mhx6","https://nvd.nist.gov/vuln/detail/CVE-2026-9673","https://github.com/mrodrig/json-2-csv/commit/0fdd0bb6d0273178cd940afc323ccbce19688229","https://gist.github.com/whoamins/299745a2d36b482b44e9613b78e40613","https://github.com/mrodrig/json-2-csv","https://github.com/mrodrig/json-2-csv/blob/main/src/json2csv.ts%23L410","https://security.snyk.io/vuln/SNYK-JS-JSON2CSV-14221326"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-g27c-q7cp-mhx6","url":"https://osv.dev/vulnerability/GHSA-g27c-q7cp-mhx6"}],"summary":"json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio"}