Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1236: Improper Neutralization of Formula Elements in a CSV File

Base Incomplete

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

How to prevent it (3 mitigations)

  1. Implementation

    When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).

  2. Implementation

    If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.

  3. Architecture and Design

    Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.

Source: MITRE CWE-1236

All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

  • Critical 9.6
    CVE-2026-47705

    TypeBot vulnerable to CSV injection in result export

    TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or escape user-supplied input when generating CSV files. An attacker can inject spreadsheet formulas into…

    baptisteArno typebot.io
  • Critical 9.8
    CVE-2026-31049

    An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code and escalate privil…

  • Critical 9.8
    CVE-2020-36962 EPSS 12%

    Tendenci 12.3.1 - CSV/ Formula Injection

    Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads like '=10+20+cmd|' /C calc'!A0' in the message field to tr…

    tendenci tendenci tendenci PyPI
  • Critical 9.8
    CVE-2021-47901

    dirsearch 0.4.1 - CSV Injection

    Dirsearch 0.4.1 contains a CSV injection vulnerability when using the --csv-report flag that allows attackers to inject formulas through redirected endpoints. Attackers can craft malicious server redirects with comma-separated paths containing Excel formulas …

    maurosoria dirsearch
  • Critical 9.8
    CVE-2020-36941

    Knockpy 4.1.1 - CSV Injection

    Knockpy 4.1.1 contains a CSV injection vulnerability that allows attackers to inject malicious formulas into CSV reports through unfiltered server headers. Attackers can manipulate server response headers to include spreadsheet formulas that will execute when…

    guelfoweb knock
  • Critical 9.8
    CVE-2025-56267

    A CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbit…

  • Critical 9.8
    CVE-2023-47295

    A CSV injection vulnerability in NCR Terminal Handler v1.5.1 allows attackers to execute arbitrary commands via injecti…

  • Critical 9.8
    CVE-2024-55532

    Apache Ranger: Improper Neutralization of Formula Elements in a CSV File

    Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version < 2.6.0. Users are recommended to upgrade to version 2.6.0, which fixes this issue.

    Apache Software Foundation Apache Ranger org.apache.ranger:security-admin-web Maven
  • Critical 9.8
    CVE-2024-29375 Public exploit

    CSV Injection vulnerability in Addactis IBNRS v.3.10.3.107 allows a remote attacker to execute arbitrary code via a cra…

  • Critical 9.8
    CVE-2022-3574

    WPForms Pro < 1.7.7 - CSV Injection

    The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection.

    Web / CMS
  • Critical 9.8
    CVE-2022-3463

    FluentForm < 4.3.13 - CSV Injection

    The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection

    Web / CMS
  • Critical 9.8
    CVE-2022-22425

    "IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arb…

  • Critical 9.8
    CVE-2022-3393

    Post to CSV by BestWebSoft <= 1.4.0 - Author+ CSV Injection

    The Post to CSV by BestWebSoft WordPress plugin through 1.4.0 does not properly escape fields when exporting data as CSV, leading to a CSV injection

    Web / CMS
  • Critical 9.0
    CVE-2022-2112

    Improper Neutralization of Formula Elements in a CSV File in inventree/inventree

    Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.

    inventree inventree/inventree inventree PyPI
  • Critical 9.8
    CVE-2022-28481

    CSV-Safe improperly filters special characters potentially leading to CSV injection

    CSV-Safe gem < 3.0.0 doesn't filter out special characters which could trigger CSV Injection.

    csv-safe RubyGems
  • Critical 9.8
    CVE-2017-18900

    Mattermost Server is vulnerable CSV Injection

    An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows CSV injection via a compliance report.

    github.com/mattermost/mattermost-server Go
  • Critical 9.8
    CVE-2018-8092

    CSV Injection vulnerability with exported contact lists in Mautic

    Mautic before 2.13.0 allows CSV injection.

    mautic/core Packagist