A malformed CSV header containing a duplicate "__proto__" entry allows the parser to set an attacker‑controlled value on the object prototype. This can inject arbitrary properties into parsed records, hide these values from JSON serialization, and alter property enumeration and type checks within consuming applications. The flaw can compromise data integrity and potentially mislead application logic that relies on record contents.

Node‑csv v7.0.1 and earlier from adaltas are vulnerable when the columns or group_columns_by_name options are enabled. The issue has been resolved in node‑csv v7.0.2 and later.

The CVSS score of 6.9 indicates moderate risk. EPSS data is unavailable and the vulnerability is not listed in CISA KEV. The likely attack vector involves an application parsing a CSV file supplied by an attacker; if the application accepts user‑controlled CSV content (e.g., via upload or API), an attacker can exploit the prototype injection by crafting an appropriate header. Attack prerequisites include the use of the vulnerable options and the presence of a duplicate "__proto__" header. Once exploited, the attacker can tamper with record contents and affect downstream application behavior.