Every CVE Search/ Get API key

CVE-2022-39217

Improper Neutralization of Formula Elements in a CSV File in ghas-to-csv

5.8 MediumFix available

some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom field contains executable code / formulas, it might be run when an endpoint opens that CSV file in a spreadsheet program. This issue has been addressed in version v1. Users are advised to use v1 or later. There are no known workarounds for this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.59%Down 0.3 points since Sep 17, 2022
90%50%10%1%

What each source reports

CVE List Score used 5.8

Improper Neutralization of Formula Elements in a CSV File in ghas-to-csv

some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom field contains executable code / formulas, it might be run when an endpoint opens that CSV file in a spreadsheet program. This issue has been addressed in version v1. Users are advised to use v1 or later. There are no known workarounds for this issue.

Record
CVE-2022-39217
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Weakness
CWE-74
Updated
2026-11-02
EUVDEUVD-2022-6716 5.8

some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom field contains executable code / formulas, it might be run when an endpoint opens that CSV file in a spreadsheet program. This issue has been addressed in version v1. Users are advised to use v1 or later. There are no known workarounds for this issue.

Record
EUVD-2022-6716
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-634p-93h9-92vh 5.8

ghas-to-csv vulnerable to Improper Neutralization of Formula Elements in a CSV File

Impact

This GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom field contains executable code / formulas, it might be run when an endpoint opens that CSV file in a spreadsheet program. The data flow looks like this 👇🏻

graph TD
    A(Repository) -->|developer dismissal, other data input| B(GitHub Advanced Security data)
    B -->|ghas-to-csv| C(CSV file)
    C -->|spreadsheet program| D(endpoint executes potentially malicious code)

Patches

Please use version v1 or later. That tag moves from using csv to defusedcsv to mitigate this problem.

Workarounds

There is no workaround. Please upgrade to using the latest tag, v1 (or later).

References

  • CWE-1236 information from MITRE
  • CSV injection information from OWASP
  • CodeQL query for CWE-1236 in Python here
  • PyPI site for defusedcsv here

For more information

If you have any questions or comments about this advisory:

  • Open an issue in this repository here
Record
GHSA-634p-93h9-92vh
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Weakness
CWE-74, CWE-1236
Updated
2026-11-02
NVD 5.8

some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom field contains executable code / formulas, it might be run when an endpoint opens that CSV file in a spreadsheet program. This issue has been addressed in version v1. Users are advised to use v1 or later. There are no known workarounds for this issue.

Record
CVE-2022-39217
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-74
Updated
2026-11-02
OSV 5.8

Improper Neutralization of Formula Elements in a CSV File in ghas-to-csv

some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom field contains executable code / formulas, it might be run when an endpoint opens that CSV file in a spreadsheet program. This issue has been addressed in version v1. Users are advised to use v1 or later. There are no known workarounds for this issue.

Record
CVE-2022-39217
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Weakness
CWE-74
Updated
2026-11-02
OSVGHSA-634p-93h9-92vh 5.8

ghas-to-csv vulnerable to Improper Neutralization of Formula Elements in a CSV File

Impact

This GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom field contains executable code / formulas, it might be run when an endpoint opens that CSV file in a spreadsheet program. The data flow looks like this 👇🏻

graph TD
    A(Repository) -->|developer dismissal, other data input| B(GitHub Advanced Security data)
    B -->|ghas-to-csv| C(CSV file)
    C -->|spreadsheet program| D(endpoint executes potentially malicious code)

Patches

Please use version v1 or later. That tag moves from using csv to defusedcsv to mitigate this problem.

Workarounds

There is no workaround. Please upgrade to using the latest tag, v1 (or later).

References

  • CWE-1236 information from MITRE
  • CSV injection information from OWASP
  • CodeQL query for CWE-1236 in Python here
  • PyPI site for defusedcsv here

For more information

If you have any questions or comments about this advisory:

  • Open an issue in this repository here
Record
GHSA-634p-93h9-92vh
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Weakness
CWE-1236, CWE-74
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
some-natalie/ghas-to-csv
GitHub Actions
 before 1
1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-39217 is a medium vulnerability (CVSS 5.8) in Ghas-to-csv Project Ghas-to-csv, published September 16, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in some-natalie/ghas-to-csv 1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open