Weakness (CWE)
CWE-1236: Improper Neutralization of Formula Elements in a CSV File
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
How to prevent it (3 mitigations)
-
Implementation
When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
-
Implementation
If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
-
Architecture and Design
Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.
Source: MITRE CWE-1236
74 results · Clear filters · Feed
-
High 7.0
IBM Cloud Pak for Automation CSV injection
IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, cause…
-
High 8.8
CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management …
-
High 8.4
Potential CSV export data leak
In ActiveAdmin (aka Active Admin) before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data (that belongs to another user) by making CSV export requests at certain specific times.
-
High 8.0
IBM Security Guardium CSV injection
IBM Security Guardium 11.3, 11.4, and 11.5 is potentially vulnerable to CSV injection. A remote attacker could execute malicious commands due to improper validation of csv file contents. IBM X-Force ID: 265262.
-
High 7.6
WordPress Export Users Data CSV Plugin <= 2.1 is vulnerable to CSV Injection
Improper Neutralization of Formula Elements in a CSV File vulnerability in Kaushik Kalathiya Export Users Data CSV.This issue affects Export Users Data CSV: from n/a through 2.1.
-
High 8.8
WordPress KB Support Plugin <= 1.5.84 is vulnerable to CSV Injection
Improper Neutralization of Formula Elements in a CSV File vulnerability in WPOmnia KB Support.This issue affects KB Support: from n/a through 1.5.84.
-
High 7.0
IBM InfoSphere Information Server CSV injection
IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 244368.
-
High 8.8
Improper Neutralization of Formula Elements in a CSV File in thorsten/phpmyfaq
Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
-
High 7.3
Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File
Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File
-
High 7.0
IBM Watson Knowledge Catalog CSV injection
IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 251782.
-
High 7.7
Improper Neutralization of Formula Elements in a CSV File in fossbilling/fossbilling
Improper Neutralization of Formula Elements in a CSV File in GitHub repository fossbilling/fossbilling prior to 0.5.3.
-
High 8.3
Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution …
-
High 8.8CVE-2023-33410 Public exploit
Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The v…
-
High 7.8
ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields w…
-
High 8.8
Improper Neutralization of Formula Elements in a CSV File in alfio-event/alf.io
Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
-
High 8.0
TEAM JOHNLONG SOFTWARE CO., LTD. MAILD Mail Server - Formula Injection
A remote attacker with general user privilege can inject malicious code in the form content of Raiden MAILD Mail Server website. Other users export form content as CSV file can trigger arbitrary code execution and allow the attacker to perform arbitrary syste…
-
High 7.8CVE-2022-44830 Public exploit
Sourcecodester Event Registration App v1.0 was discovered to contain multiple CSV injection vulnerabilities via the Fir…
-
High 7.4
WordPress Activity Log plugin <= 2.8.3 - CSV Injection vulnerability
CSV Injection vulnerability in Activity Log Team Activity Log <= 2.8.3 on WordPress.
-
High 8.0
Import and export users and customers < 1.20.5 - Subscriber+ CSV Injection
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files.
-
High 8.8
CSV Injection in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC
The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within export data and then triggered in exported data viewers.
-
High 8.0
ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20220721.14829 was discovered to contain a CSV injection v…
-
High 8.0
Improper Neutralization of Formula Elements in a CSV File in kromitgmbh/titra
Improper Neutralization of Formula Elements in a CSV File in GitHub repository kromitgmbh/titra prior to 0.77.0.
-
High 8.0
Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in luyadev/yii-helpers
Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remo…
-
High 7.8
MantisBT CSV Injection unprivileged user access in csv_export.php
Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens the csv_export.php generated CSV file in Excel.
-
High 7.8
Improper Neutralization of Formula Elements in a CSV File in Kimai 2
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling the Description field with malicious payload, it will be mistreated while exporting to a CSV file.
-
High 8.8
Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging
`gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutralization of Formula Elements in a CSV File. The `gradio` library has a flagging functionality which …
-
High 7.8CVE-2021-46363 Public exploit
Arbitrary code execution in Magnolia CMS
An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files. These formulas may result in arbitrary code execution on a victim's computer when opening the exported files with Mic…
-
High 8.0
NocoDB - CSV Injection in User Management
In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can create a new table to inject payloads in the table rows. When an administrator accesses the User Management endpoint and e…
-
High 8.8
CSV Injection Vulnerability
Craft CMS before 3.7.14 allows CSV injection.
-
High 8.0
SuiteCRM - CSV Injection in Accounts Module
In “SuiteCRM” application, v7.11.18 through v7.11.19 and v7.10.29 through v7.10.31 are affected by “CSV Injection” vulnerability (Formula Injection). A low privileged attacker can use accounts module to inject payloads in the input fields. When an administrat…
-
High 8.0
Shuup - Formula Injection in Checkout Addresses
“Shuup” application in versions 0.4.2 to 2.10.8 is affected by the “Formula Injection” vulnerability. A customer can inject payloads in the name input field in the billing address while buying a product. When a store administrator accesses the reports page to…
-
High 8.0
Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore
Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patched in 10.1.1. Aside from upgrading, one may apply the patch manually as a workaround.
-
High 8.8
A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to…
-
High 7.8
Alkacon OpenCMS CSV Injection via New User module
Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp) via the First Name or Last Name.