AIKIDO-2026-149515

TL;DR

csv-parse builds record objects from CSV header names when the columns option is enabled. With group_columns_by_name also enabled, a duplicated header such as __proto__ reaches the duplicate-column branch, which assigns an array to obj['__proto__'] and invokes the prototype setter, replacing the parsed record's prototype with input-controlled data. Before the fix this let untrusted CSV header rows replace or pollute the record prototype. The fix uses Object.hasOwn for the duplicate check and Object.defineProperty for assignment so a __proto__ column becomes an ordinary own property.