Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1236: Improper Neutralization of Formula Elements in a CSV File

Base Incomplete

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

How to prevent it (3 mitigations)

  1. Implementation

    When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).

  2. Implementation

    If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.

  3. Architecture and Design

    Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.

Source: MITRE CWE-1236

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-60852 Public exploit

    A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600. Applications built w…

  • Medium 5.4
    CVE-2023-29918 Public exploit

    RosarioSIS vulnerable to CSV Injection

    RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.

    francoisjacquet/rosariosis Packagist