Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1236: Improper Neutralization of Formula Elements in a CSV File

Base Incomplete

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

How to prevent it (3 mitigations)

  1. Implementation

    When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).

  2. Implementation

    If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.

  3. Architecture and Design

    Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.

Source: MITRE CWE-1236

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.8
    CVE-2026-19501 Public exploit

    CVE-2026-19501

    CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on …

    SureForms SureForms
  • Medium 6.5
    CVE-2025-60852 Public exploit

    A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600. Applications built w…

  • Critical 9.8
    CVE-2024-29375 Public exploit

    CSV Injection vulnerability in Addactis IBNRS v.3.10.3.107 allows a remote attacker to execute arbitrary code via a cra…

  • High 8.8
    CVE-2023-33410 Public exploit

    Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The v…

  • Medium 5.4
    CVE-2023-29918 Public exploit

    RosarioSIS vulnerable to CSV Injection

    RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.

    francoisjacquet/rosariosis Packagist
  • High 7.8
    CVE-2022-44830 Public exploit

    Sourcecodester Event Registration App v1.0 was discovered to contain multiple CSV injection vulnerabilities via the Fir…

  • High 7.8
    CVE-2021-46363 Public exploit

    Arbitrary code execution in Magnolia CMS

    An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files. These formulas may result in arbitrary code execution on a victim's computer when opening the exported files with Mic…

    info.magnolia:magnolia-core Maven