AIKIDO-2026-79918
fastcsv is vulnerable to Data Integrity Violation
63
Medium Risk
This Affects:
fastcsvTL;DR
IndexedCsvReader builds its page index with a byte-level scanner while pages are decoded and parsed at the character level. When the configured character set is neither UTF-8 nor a single-byte encoding that maps ASCII bytes to identical characters, the byte index and the character parser desynchronize. Records are silently lost or invented and fields are corrupted, with no exception thrown, for variable-width or ASCII-shifting charsets. The fix restricts IndexedCsvReader to UTF-8 and safe single-byte charsets and rejects other charsets at construction.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use IndexedCsvReader with a character set that is neither UTF-8 nor a single-byte encoding that maps ASCII bytes to identical characters.
Background info
fastcsv is vulnerable to Data Integrity Violation in versions 3.0.0 - 4.3.1.
How to fix this
Upgrade the fastcsv and/or the de.siegmar:fastcsv library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant