CWE-1236
AllowedImproper Neutralization of Formula Elements in a CSV File
Abstraction: Base · Status: Incomplete
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
429 vulnerabilities reference this CWE, most recent first.
GHSA-42FC-CX25-7F9X
Vulnerability from github – Published: 2023-06-09 06:30 – Updated: 2024-04-04 04:41The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
{
"affected": [],
"aliases": [
"CVE-2023-0721"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-09T06:15:53Z",
"severity": "HIGH"
},
"details": "The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.",
"id": "GHSA-42fc-cx25-7f9x",
"modified": "2024-04-04T04:41:16Z",
"published": "2023-06-09T06:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0721"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/metform/trunk/core/entries/export.php?rev=2845078"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/2907471"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd85a72-1872-4c4f-8ba7-7f91b0b37d4a?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-42PG-83VP-H57G
Vulnerability from github – Published: 2022-11-29 06:30 – Updated: 2022-11-29 06:30A remote attacker with general user privilege can inject malicious code in the form content of Raiden MAILD Mail Server website. Other users export form content as CSV file can trigger arbitrary code execution and allow the attacker to perform arbitrary system operation or disrupt service on the user side.
{
"affected": [],
"aliases": [
"CVE-2022-41675"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-29T04:15:00Z",
"severity": "HIGH"
},
"details": "A remote attacker with general user privilege can inject malicious code in the form content of Raiden MAILD Mail Server website. Other users export form content as CSV file can trigger arbitrary code execution and allow the attacker to perform arbitrary system operation or disrupt service on the user side.",
"id": "GHSA-42pg-83vp-h57g",
"modified": "2022-11-29T06:30:19Z",
"published": "2022-11-29T06:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41675"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-6738-b78f4-1.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4386-29WM-8H9P
Vulnerability from github – Published: 2023-09-06 21:32 – Updated: 2024-04-04 07:32SearchBlox before Version 9.2.1 is vulnerable to CSV macro injection in "Featured Results" parameter.
{
"affected": [],
"aliases": [
"CVE-2020-10131"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-06T19:15:43Z",
"severity": "CRITICAL"
},
"details": "SearchBlox before Version 9.2.1 is vulnerable to CSV macro injection in \"Featured Results\" parameter.",
"id": "GHSA-4386-29wm-8h9p",
"modified": "2024-04-04T07:32:15Z",
"published": "2023-09-06T21:32:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10131"
},
{
"type": "WEB",
"url": "https://developer.searchblox.com/v9.2/changelog/version-921"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-44GH-JRG2-9M35
Vulnerability from github – Published: 2022-05-13 01:18 – Updated: 2022-05-13 01:18The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection.
{
"affected": [],
"aliases": [
"CVE-2018-10504"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-27T16:29:00Z",
"severity": "HIGH"
},
"details": "The WebDorado \"Form Maker by WD\" plugin before 1.12.24 for WordPress allows CSV injection.",
"id": "GHSA-44gh-jrg2-9m35",
"modified": "2022-05-13T01:18:50Z",
"published": "2022-05-13T01:18:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10504"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/form-maker/#developers"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/44559"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-452H-X3W8-JMMH
Vulnerability from github – Published: 2024-03-12 15:32 – Updated: 2024-03-12 15:32A improper neutralization of formula elements in a csv file in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.10, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8 allows attacker to execute unauthorized code or commands via specially crafted packets.
{
"affected": [],
"aliases": [
"CVE-2023-47534"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-12T15:15:46Z",
"severity": "CRITICAL"
},
"details": "A improper neutralization of formula elements in a csv file in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.10, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8 allows attacker to execute unauthorized code or commands via specially crafted packets.",
"id": "GHSA-452h-x3w8-jmmh",
"modified": "2024-03-12T15:32:21Z",
"published": "2024-03-12T15:32:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47534"
},
{
"type": "WEB",
"url": "https://fortiguard.com/psirt/FG-IR-23-390"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-46X4-34F2-J42G
Vulnerability from github – Published: 2022-05-24 22:01 – Updated: 2024-02-14 18:30A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user's PC.
{
"affected": [],
"aliases": [
"CVE-2019-17661"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-11-08T18:15:00Z",
"severity": "HIGH"
},
"details": "A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user\u0027s PC.",
"id": "GHSA-46x4-34f2-j42g",
"modified": "2024-02-14T18:30:24Z",
"published": "2022-05-24T22:01:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17661"
},
{
"type": "WEB",
"url": "https://www2.deloitte.com/de/de/pages/risk/articles/wordpress-csv-injection.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4C36-3WHG-3PPX
Vulnerability from github – Published: 2022-05-13 01:18 – Updated: 2022-05-13 01:18A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.
{
"affected": [],
"aliases": [
"CVE-2018-10257"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-05-01T19:29:00Z",
"severity": "HIGH"
},
"details": "A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.",
"id": "GHSA-4c36-3whg-3ppx",
"modified": "2022-05-13T01:18:49Z",
"published": "2022-05-13T01:18:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10257"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/44536"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/147364/HRSALE-The-Ultimate-HRM-1.0.2-CSV-Injection.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4FC7-7QM8-3HR4
Vulnerability from github – Published: 2022-05-13 01:21 – Updated: 2022-05-13 01:21Open-AudIT before 2.2 has CSV Injection.
{
"affected": [],
"aliases": [
"CVE-2018-9137"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-19T08:29:00Z",
"severity": "MODERATE"
},
"details": "Open-AudIT before 2.2 has CSV Injection.",
"id": "GHSA-4fc7-7qm8-3hr4",
"modified": "2022-05-13T01:21:05Z",
"published": "2022-05-13T01:21:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-9137"
},
{
"type": "WEB",
"url": "https://community.opmantek.com/display/OA/Errata+-+2.1+Security+Update%2C+April+2018"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/44511"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4FGP-7VVM-M4JF
Vulnerability from github – Published: 2024-09-12 15:33 – Updated: 2024-09-20 19:16An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a maliciously crafted CSV file containing Python code, the code will be passed to an eval function which executes it.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "refuel-autolabel"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.8"
},
{
"last_affected": "0.0.16"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-27321"
],
"database_specific": {
"cwe_ids": [
"CWE-1236",
"CWE-95"
],
"github_reviewed": true,
"github_reviewed_at": "2024-09-12T19:49:50Z",
"nvd_published_at": "2024-09-12T13:15:12Z",
"severity": "HIGH"
},
"details": "An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a maliciously crafted CSV file containing Python code, the code will be passed to an eval function which executes it.",
"id": "GHSA-4fgp-7vvm-m4jf",
"modified": "2024-09-20T19:16:57Z",
"published": "2024-09-12T15:33:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27321"
},
{
"type": "PACKAGE",
"url": "https://github.com/refuel-ai/autolabel"
},
{
"type": "WEB",
"url": "https://github.com/refuel-ai/autolabel/blob/v0.0.16/src/autolabel/dataset/validation.py#L129-L146"
},
{
"type": "WEB",
"url": "https://hiddenlayer.com/sai-security-advisory/2024-09-autolabel"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Refuel Autolab Eval Injection vulnerability"
}
GHSA-4HVR-HGMW-438R
Vulnerability from github – Published: 2023-07-19 00:31 – Updated: 2024-04-04 06:16A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a spreadsheet software
such as Microsoft Excel.
{
"affected": [],
"aliases": [
"CVE-2023-3527"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-18T22:15:09Z",
"severity": "MODERATE"
},
"details": "A CSV injection vulnerability was found in the\u00a0Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a spreadsheet software \n\nsuch as Microsoft Excel.\n\n\u00a0\n\n",
"id": "GHSA-4hvr-hgmw-438r",
"modified": "2024-04-04T06:16:36Z",
"published": "2023-07-19T00:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3527"
},
{
"type": "WEB",
"url": "https://download.avaya.com/css/public/documents/101086364"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
Mitigation
If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
Mitigation
Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.
No CAPEC attack patterns related to this CWE.