Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1236: Improper Neutralization of Formula Elements in a CSV File

Base Incomplete

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

How to prevent it (3 mitigations)

  1. Implementation

    When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).

  2. Implementation

    If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.

  3. Architecture and Design

    Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.

Source: MITRE CWE-1236

All Critical High Medium Low Exploited only Public exploit

222 results · Feed

  • High 7.8
    CVE-2021-46363 Public exploit

    Arbitrary code execution in Magnolia CMS

    An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files. These formulas may result in arbitrary code execution on a victim's computer when opening the exported files with Mic…

    info.magnolia:magnolia-core Maven
  • Unscored —
    CVE-2022-22689

    CA Harvest Software Change Manager versions 13.0.3, 13.0.4, 14.0.0, and 14.0.1, contain a vulnerability in the CSV expo…

  • High 8.0
    CVE-2022-22121

    NocoDB - CSV Injection in User Management

    In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can create a new table to inject payloads in the table rows. When an administrator accesses the User Management endpoint and e…

    nocodb nocodb
  • Medium 5.6
    CVE-2021-23654

    Improper Input Validation

    This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a…

    html-to-csv PyPI
  • Medium 6.5
    CVE-2021-41270

    CSV Injection in Symfony

    Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Symfony versions 4.1.0 before 4.4.35 and versions 5.0.0 before 5.3.12 are vulnerable t…

    symfony symfony symfony/symfony symfony Debian Ubuntu Packagist
  • Medium 5.9
    CVE-2021-38424

    Delta Electronics DIALink

    The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data. Those formulas may then be executed when it is opened with a spreadsheet application.

    Delta Electronics DIALink ICS / OT
  • Unscored —
    CVE-2020-36503

    Connections Business Directory < 9.7 - Admin+ CSV Injection

    The Connections Business Directory WordPress plugin before 9.7 does not validate or sanitise some connections' fields, which could lead to a CSV injection issue

    Web / CMS
  • Unscored —
    CVE-2021-38180

    SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due…

    SAP SAP Business One
  • High 8.8
    CVE-2021-41824

    CSV Injection Vulnerability

    Craft CMS before 3.7.14 allows CSV injection.

    craftcms/cms Packagist
  • High 8.0
    CVE-2021-25960

    SuiteCRM - CSV Injection in Accounts Module

    In “SuiteCRM” application, v7.11.18 through v7.11.19 and v7.10.29 through v7.10.31 are affected by “CSV Injection” vulnerability (Formula Injection). A low privileged attacker can use accounts module to inject payloads in the input fields. When an administrat…

    salesagility SuiteCRM
  • High 8.0
    CVE-2021-25962

    Shuup - Formula Injection in Checkout Addresses

    “Shuup” application in versions 0.4.2 to 2.10.8 is affected by the “Formula Injection” vulnerability. A customer can inject payloads in the name input field in the billing address while buying a product. When a store administrator accesses the reports page to…

    shuup shuup shuup PyPI
  • High 8.0
    CVE-2021-37702

    Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore

    Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patched in 10.1.1. Aside from upgrading, one may apply the patch manually as a workaround.

    pimcore pimcore pimcore/pimcore Packagist
  • Unscored —
    CVE-2021-22771

    A CWE-1236: Improper Neutralization of Formula Elements in a CSV File vulnerability exists in Easergy T300 with firmwar…

  • Unscored —
    CVE-2021-24441

    Sign-up Sheets < 1.0.14 - Authenticated CSV Injection

    The Sign-up Sheets WordPress plugin before 1.0.14 does not not sanitise or validate the Sheet title when generating the CSV to export, which could lead to a CSV injection issue

    Web / CMS
  • Medium 6.5
    CVE-2021-1475

    Cisco Umbrella Link and CSV Formula Injection Vulnerabilities

    Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and link injection attacks on an affected device. For more information about these …

    Cisco Cisco Umbrella Insights Virtual Appliance Network devices
  • Medium 6.5
    CVE-2021-1474

    Cisco Umbrella Link and CSV Formula Injection Vulnerabilities

    Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and link injection attacks on an affected device. For more information about these …

    Cisco Cisco Umbrella Insights Virtual Appliance Network devices
  • Unscored —
    CVE-2020-25170

    B. Braun OnlineSuite

    An Excel Macro Injection vulnerability exists in the export feature in the B. Braun OnlineSuite Version AP 3.0 and earlier via multiple input fields that are mishandled in an Excel export.

    B. Braun Melsungen OnlineSuite
  • Unscored —
    CVE-2020-16214

    Philips Patient Monitoring Devices Improper Neutralization of Formula Elements in a CSV File

    In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the software saves user-provided information into a comma-separated value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a com…

    Philips Patient Information Center iX (PICiX)
  • Critical 9.8
    CVE-2017-18900

    Mattermost Server is vulnerable CSV Injection

    An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows CSV injection via a compliance report.

    github.com/mattermost/mattermost-server Go
  • High 8.8
    CVE-2019-17661

    A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to…

  • High 7.8
    CVE-2019-11819

    Alkacon OpenCMS CSV Injection via New User module

    Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp) via the First Name or Last Name.

    org.opencms:opencms-core Maven
  • Critical 9.8
    CVE-2018-8092

    CSV Injection vulnerability with exported contact lists in Mautic

    Mautic before 2.13.0 allows CSV injection.

    mautic/core Packagist