Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| json-2-csv | npm | >= 3.15.0, < 5.5.11 | 5.5.11 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in a faulty regular expression within the json-2-csv library, specifically designed to prevent CSV injection attacks. The analysis of the patch commit 0fdd0bb6d0273178cd940afc323ccbce19688229 reveals the exact point of failure. The file src/json2csv.ts contains the Json2Csv function, which acts as a constructor for the converter. Inside this function, an inner function named preventCsvInjection is defined to handle the sanitization of input values when the preventCsvInjection option is enabled. The vulnerable code was fieldValue.replace(/^[=+\-@\t\r]+/g, ''), which was insufficient because it did not account for leading whitespace. The patch corrects this by changing the regex to /^[ \t\r]*[=+\-@\t\r]+/g, which now strips leading whitespace before checking for the malicious characters. The vulnerable function is identified as Json2Csv because it is the component that encapsulates and applies this flawed logic. During runtime, a profiler would likely indicate that execution time is spent within this function or its methods when the vulnerability is triggered.
