Prototype Pollution in `csv42`

# Prototype Pollution in `csv42`

## Summary

`csv42` (<= 5.0.3) is vulnerable to **Prototype Pollution** via `csv42.setIn`.

- **CWE**: [CWE-1321](https://cwe.mitre.org/data/definitions/1321.html) - Improperly Controlled Modification of Object Prototype Attributes
- **Severity**: Critical (CVSS 9.8)
- **Weekly Downloads**: 2,336
- **npm**: https://www.npmjs.com/package/csv42

## Description

The function(s) `csv42.setIn` in `csv42` do not properly restrict modifications to `Object.prototype`. When processing user-controlled input, an attacker can inject properties via `__proto__` or `constructor.prototype` keys, polluting the prototype of all JavaScript objects in the application.

Attack vectors: `array-path __proto__`

## Proof of Concept

```javascript
const target = require('csv42');

// 1. Pollute Object.prototype
const malicious = JSON.parse('{"__proto__":{"polluted":"yes"}}');
csv42.setIn({}, ["__proto__", key], "value");

// 2. Verify pollution
const obj = {};
console.log(obj.polluted); // "yes" - prototype is polluted
console.log('Vulnerable:', obj.polluted === 'yes');
```

## Impact

Successful exploitation allows an attacker to:

- **Remote Code Execution (RCE)** via `child_process` spawn injection or `vm` sandbox escape
- **Authentication Bypass** via polluted authorization checks
- **SQL Injection** through polluted query parameters
- **Denial of Service (DoS)** by overriding critical object methods
- **SSRF** through polluted URL/host configurations
- **Cross-Site Scripting (XSS)** via polluted template variables
- **Path Traversal** through polluted file path configurations
- **CORS Bypass** via polluted origin/header settings

## Remediation

Add key filtering to prevent prototype pollution:

```javascript
function isSafe(key) {
return key !== '__proto__' && key !== 'constructor' && key !== 'prototype';
}
```

Or use `Object.create(null)` for target objects to prevent prototype chain access.

## References

- [CWE-1321: Improperly Controlled Modification of Object Prototype Attributes](https://cwe.mitre.org/data/definitions/1321.html)
- [OWASP Prototype Pollution](https://owasp.org/www-project-web-security-testing-guide/)
- https://www.npmjs.com/package/csv42