CVE-2026-129133

MRBS before 1.13.0 CSV Formula Injection via Report Export

5.1 Medium

MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape() function in web/report.php fails to neutralize leading formula characters. Attackers can store formulas in booking names, descriptions or custom fields that execute when privileged users open exported CSV reports, enabling data exfiltration or command execution via DDE.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Passive

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

What each source reports

CVE List Score used5.1

MRBS before 1.13.0 CSV Formula Injection via Report Export

Record: CVE-2026-129133
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-1236
Updated: 2026-11-13

EUVDEUVD-2026-1255465.1

Record: EUVD-2026-125546
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Updated: 2026-11-13

GitHub AdvisoriesGHSA-jrr2-f5c5-j7qw5.1

MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users...

Record: GHSA-jrr2-f5c5-j7qw
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-1236
Updated: 2026-11-13

NVD5.1

Record: CVE-2026-129133
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-1236
Updated: 2026-11-13

Affected products

meeting-room-booking-system mrbs-code

History

History
Recorded	Changed	Sources
Nov 13, 2026	published	EUVD
Nov 13, 2026	published	EUVD, NVD
Nov 13, 2026	aliases, references	GitHub Advisories
Nov 13, 2026	aliases, published	EUVD
Nov 13, 2026	first indexed	CVE List

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-129133 is a medium vulnerability (CVSS 5.1) in Meeting-room-booking-system Mrbs-code, published November 13, 2026. No source lists public exploit code. No source names a fixed version.