{"id":"GHSA-7rq4-qcpw-74gq","aliases":[],"status":"published","title":"Formula Injection in Exported Data","description":"### Impact\n\nDatasets exported to file (e.g. CSV / XLS) are not sufficiently sanitized, to neutralize potential formula injection\n\n### Patches\n\n- The issue is addressed in the upcoming 0.8.0 release\n- This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release\n\n### Workarounds\n\nUsers exporting untrusted data should open the files in safe mode (e.g. in Microsoft Excel).\n\n### References\n\n- https://huntr.dev/bounties/e57c36e7-fa39-435f-944a-3a52ee066f73/\n- https://owasp.org/www-community/attacks/CSV_Injection\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [github](http://github.com/inventree/inventree)\n* Email us at [security@inventree.org](mailto:security@inventree.org)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-06-17T01:17:22Z","modified":"2024-12-08T05:27:25Z","fixes":[{"ecosystem":"PyPI","package":"inventree","fixed_in":["0.7.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"inventree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"inventree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2"}]}],"versions":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9","0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.2.4","0.3.1","0.3.2","0.4.4","0.6.0","0.6.1","0.7.0","0.7.1"]}],"references":[{"url":"https://github.com/inventree/InvenTree/security/advisories/GHSA-7rq4-qcpw-74gq","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7rq4-qcpw-74gq"},{"url":"https://github.com/inventree/inventree-python","tags":["web"]}],"sources":{"ghsa":[{"id":"GHSA-7rq4-qcpw-74gq","title":"Formula Injection in Exported Data","description":"### Impact\n\nDatasets exported to file (e.g. CSV / XLS) are not sufficiently sanitized, to neutralize potential formula injection\n\n### Patches\n\n- The issue is addressed in the upcoming 0.8.0 release\n- This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release\n\n### Workarounds\n\nUsers exporting untrusted data should open the files in safe mode (e.g. in Microsoft Excel).\n\n### References\n\n- https://huntr.dev/bounties/e57c36e7-fa39-435f-944a-3a52ee066f73/\n- https://owasp.org/www-community/attacks/CSV_Injection\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [github](http://github.com/inventree/inventree)\n* Email us at [security@inventree.org](mailto:security@inventree.org)\n","status":"published","published":"2022-06-17T01:17:22Z","modified":"2023-01-12T05:01:10Z","updated_at":"2026-11-02T14:36:13.23016Z"}],"osv":[{"id":"GHSA-7rq4-qcpw-74gq","title":"Formula Injection in Exported Data","description":"### Impact\n\nDatasets exported to file (e.g. CSV / XLS) are not sufficiently sanitized, to neutralize potential formula injection\n\n### Patches\n\n- The issue is addressed in the upcoming 0.8.0 release\n- This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release\n\n### Workarounds\n\nUsers exporting untrusted data should open the files in safe mode (e.g. in Microsoft Excel).\n\n### References\n\n- https://huntr.dev/bounties/e57c36e7-fa39-435f-944a-3a52ee066f73/\n- https://owasp.org/www-community/attacks/CSV_Injection\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [github](http://github.com/inventree/inventree)\n* Email us at [security@inventree.org](mailto:security@inventree.org)\n","status":"published","published":"2022-06-17T01:17:22Z","modified":"2024-12-08T05:27:25.214106Z","updated_at":"2026-11-02T15:46:41.349637Z"}]}}