CWE-1236: CSV Injection
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Also known as Improper Neutralization of Formula Elements in a CSV File, Formula Injection, Excel Macro Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- coupa total spend management platform Multiple vulnerabilities in Coupa’s Total Spend Management Platform 7.3 High
- tanium discover Tanium addressed an improper output sanitization vulnerability in Discover. 4.1 Medium
- azuracast AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export 5.1 Medium
- saturday drive ninja forms Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields 5.1 Medium
- icagenda.com icagenda extension for joomla Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16 5.3 Medium
- tanium enforce Tanium addressed an improper output sanitization vulnerability in Enforce. 7.1 High
- tanium comply Tanium addressed an improper output sanitization vulnerability in Comply. 7.1 High
- part-db part-db-server Part-DB: Spreadsheet Formula Injection in XLSX Part Exports 4.6 Medium
- espocrm EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export 5.4 Medium
- thelia Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports 2.3 Low
- otrs ag ((otrs)) community edition, otrs +1 more Insufficient Neutralization of Formula Elements in CSV Exports 6.1 Medium
- openpanel-dev openpanel OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export 2.3 Low
- openclaw OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export 5.3 Medium
- openclaw OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels 5.3 Medium
- wwbn avideo WWBN AVideo CSV Formula Injection via myComments.download.php 5.1 Medium
- grokability snipe-it Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export 5.1 Medium
- grokability snipe-it Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report 5.1 Medium
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 more Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior... 5.3 Medium
- hitachi energy microscada sys600, hitachienergy microscada x sys600 +1 more A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify... 4.6 Medium
- mongodb mongosql transition readiness tool, bi connector transition readiness report +1 more MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports 5.8 Medium
- scottchiefbaker dool Formula Injection in dool project 4.6 Medium
- exceljs exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values 8.4 High
- sureforms CVE-2026-19501 8.8 High
- rapid7 velociraptor Velociraptor CSV Formula Injection in Export Pipeline 6.1 Medium
- baptistearno typebot.io TypeBot vulnerable to CSV injection in result export 9.6 Critical
- shlinkio shlink Shlink CSV Formula Injection via Visit Export CLI 5.1 Medium
- basercms users community basercms BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a... 5.1 Medium
-
facturascripts/facturascriptsPackagist FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export 8.0 High - prestashop the firmware Incorrect neutralisation in the PrestaShop firmware 4.5 Medium
- grokability snipe-it Snipe-IT: CSV formula injection in Activity Report export 4.8 Medium
- statamic cms Statamic: CSV formula injection in form submission exports 6.1 Medium
- actualbudget actual Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields 4.2 Medium
- actualbudget actual Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helper 4.6 Medium
- mia technology inc. pizzy library Code Injection in Mia Technologies' Pizzy Library 8.8 High
- poweradmin Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications 6.9 Medium
-
spreeRubyGems Spree: CSV Formula Injection in Customer Export 5.2 Medium - hcl icontrol HCL iControl was affected by Export CSV - CSV Injection vulnerability. 7.1 High
- sourcecodester pharmacy sales and inventory system SourceCodester Pharmacy Sales and Inventory System Supplier Creation export create_supplier csv injection 5.1 Medium
-
json-2-csvnpm json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio 7.0 High - bestpractical rt RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps 4.6 Medium
- dell ecs, objectscale, elastic cloud storage +2 more Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0,... 5.8 Medium
- wger-project wger wger before 2.6 CSV Formula Injection via member export 4.8 Medium
- kimai Kimai: Formula Injection via tag names in XLSX export 5.4 Medium
- traccar traccar allows CSV formula injection via exported position data 6.5 Medium
- rajodiya erpgo saas ERPGo SaaS 3.9 CSV Injection via Vendor Creation 8.7 High
- 1panel-dev maxkb MaxKB has CSV Injection in its Application Chat Export Functionality 5.3 Medium
- No product listed An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary... 9.8 Critical
- six apart ltd. movable type (cloud edition), movable type (software edition), movable type advanced (software edition) +3 more +5 more If a malformed data is input to the affected product, a CSV file downloaded from the affected... 4.8 Medium
- moodle Moodle: moodle: formula injection allows arbitrary formula execution via unescaped data export 6.1 Medium
- tendenci Tendenci 12.3.1 - CSV/ Formula Injection 5.3 Medium
- Show olderLoading…