Improper Neutralization of Formula Elements in a CSV File
CWE-1236
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
We track 107 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.5.
How this weakness is prevented
- Implementation: When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
- Implementation: If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
- Architecture and Design: Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.
Latest Improper Neutralization of Formula Elements in a CSV File vulnerabilities
- 7.1 High severity
Gutenverse Form – Contact Form Builder, Block…: Improper Neutralization of Formula Elements in a CSV File
Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, w
- 7.3 High severity
Coupa Total Spend Management Platform: Improper Neutralization of Formula Elements in a CSV File
CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or
- 7.1 High severity
Ninja Forms: Improper Neutralization of Formula Elements in a CSV File
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Ab
- 7.8 High severity
MicroSCADA SYS600: Improper Neutralization of Formula Elements in a CSV File
A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the u
- 8.2 High severity
exceljs: Improper Neutralization of Formula Elements in a CSV File
exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application,
- 8.8 High severity
SureForms: Improper Neutralization of Formula Elements in a CSV File
CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on a
- 9.6 Critical severity
typebot.io: Improper Neutralization of Formula Elements in a CSV File
TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or escape user-supplied input when generating CSV files. An attacker can inject spreadsheet formulas into
- 7.1 High severity
BaserCMS: Improper Neutralization of Formula Elements in a CSV File
BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed.
- 7.3 High severity
snipe-it: Improper Neutralization of Formula Elements in a CSV File
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActivityReport() writes that value to the Activity Report CSV without formula escaping, allowing a low-pri
- 8.8 High severity
Pizzy Library: Improper Neutralization of Formula Elements in a CSV File
Improper neutralization of formula elements in a CSV file vulnerability in MIA Technology Inc. Pizzy Library allows Code Injection. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250.
- 8.8 High severity
iControl: Improper Neutralization of Formula Elements in a CSV File
HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters. .
- 9.8 Critical severity
ECS: Improper Neutralization of Formula Elements in a CSV File
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula elements in a CSV File vulnerability in the UI. An unauthenticated attacker with remote access could potentially exploit th
- 8.8 High severity
ERPGo SaaS: Improper Neutralization of Formula Elements in a CSV File
ERPGo SaaS 3.9 contains a CSV injection vulnerability that allows authenticated attackers to inject spreadsheet formulas into vendor name fields that execute on the workstation of users who open the exported CSV in a spreadsheet application. Attackers can add
- 7.8 High severity
Moodle: Improper Neutralization of Formula Elements in a CSV File
A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. A remote attacker could exploit this by providing malicious data that, when exported and opened in a spreadsheet, allows arbitrary fo
- 9.0 Critical severity
hustoj: Improper Neutralization of Formula Elements in a CSV File
hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Injection) through the contest rank export functionality (contestrank.xls.php and admin/ranklist_export.php
- 7.3 High severity
Trueconf Server: Improper Neutralization of Formula Elements in a CSV File
A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exported chat logs via crafted Display Name.
- 8.0 High severity
phpMyFAQ: Improper Neutralization of Formula Elements in a CSV File
phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names. Attackers can modify their user profile name with a payload like 'calc|a!z|' to trigger code execution when an adminis
- 8.8 High severity
Rukovoditel: Improper Neutralization of Formula Elements in a CSV File
Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname field. Attackers can craft payloads like =calc|a!z| to trigger code execution when an admin exports customer data as a CSV
- 8.0 High severity
projectSend: Improper Neutralization of Formula Elements in a CSV File
ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can craft payloads like =calc|a!z| in the name field to trigger code execution when administrators export a
- 8.0 High severity
Inventory Management System: Improper Neutralization of Formula Elements in a CSV File
A security vulnerability has been detected in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the component SVC Report Export. Such manipulation leads to csv injection. It is possible to launch the attack remotely
- 7.8 High severity
bagisto: Improper Neutralization of Formula Elements in a CSV File
Bagisto is an open source laravel eCommerce platform. When product data that begins with a spreadsheet formula character (for example =, +, -, or @) is accepted and later exported or saved into a CSV and opened in spreadsheet software, the spreadsheet will int
- 9.8 Critical severity
Access Control Manager: Improper Neutralization of Formula Elements in a CSV File
A CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel file.
- 7.1 High severity
AP HoneyPot WordPress Plugin: Improper Neutralization of Formula Elements in a CSV File
Improper Neutralization of Formula Elements in a CSV File vulnerability in Denis V (Artprima) AP HoneyPot WordPress Plugin ap-honeypot allows Reflected XSS.This issue affects AP HoneyPot WordPress Plugin: from n/a through <= 1.4.
- 8.8 High severity
unopim: Improper Neutralization of Formula Elements in a CSV File
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Versions 0.3.0 and prior are vulnerable to CSV injection, also known as formula injection, in the Quick Export feature. This vulnerability allows attackers to
- 7.5 High severity
eladmin: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in elunez eladmin up to 2.7. This affects the function exportUser. This manipulation causes csv injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
- 8.0 High severity
PowerCMS: Improper Neutralization of Formula Elements in a CSV File
Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user's environment, the embedded code may be executed.
- 9.8 Critical severity
Terminal Handler: Improper Neutralization of Formula Elements in a CSV File
A CSV injection vulnerability in NCR Terminal Handler v1.5.1 allows attackers to execute arbitrary commands via injecting a crafted payload into any text field that accepts strings.
- 8.8 High severity
MaxKB: Improper Neutralization of Formula Elements in a CSV File
A vulnerability was found in 1Panel-dev MaxKB up to 1.10.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Knowledge Base Module. The manipulation leads to csv injection. The attack can be launched
- 9.8 Critical severity
Apache Ranger: Improper Neutralization of Formula Elements in a CSV File
Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version < 2.6.0. Users are recommended to upgrade to version 2.6.0, which fixes this issue.
- 8.8 High severity
Meeting Room Booking System: Improper Neutralization of Formula Elements in a CSV File
PHPJabbers Meeting Room Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System O
- 8.8 High severity
Cinema Booking System: Improper Neutralization of Formula Elements in a CSV File
PHPJabbers Cinema Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Options
- 8.8 High severity
Bus Reservation System: Improper Neutralization of Formula Elements in a CSV File
PHPJabbers Bus Reservation System v1.1 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Option
- 8.8 High severity
Car Park Booking System: Improper Neutralization of Formula Elements in a CSV File
PHPJabbers Car Park Booking System v3.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Optio
- 8.8 High severity
Hotel Booking System: Improper Neutralization of Formula Elements in a CSV File
PHPJabbers Hotel Booking System v4.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Options
- 8.0 High severity
Cognos Controller: Improper Neutralization of Formula Elements in a CSV File
IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 could allow an authenticated attacker to conduct formula injection. An attacker could execute arbitrary commands on the system, caused by improper validation of file contents.
- 8.0 High severity
FortiSOAR: Improper Neutralization of Formula Elements in a CSV File
An improper neutralization of formula elements in a csv file in Fortinet FortiSOAR 7.2.1 through 7.4.1 allows attacker to execute unauthorized code or commands via manipulating csv file
- 9.0 Critical severity
ZENIC ONE R58: Improper Neutralization of Formula Elements in a CSV File
The ZENIC ONE R58 products by ZTE Corporation have a command injection vulnerability. An authenticated attacker can exploit this vulnerability to tamper with messages, inject malicious code, and subsequently launch attacks on related devices.
- 8.0 High severity
snipe-it: Improper Neutralization of Formula Elements in a CSV File
An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and o
- 9.8 Critical severity
HikCentral Master Lite: Improper Neutralization of Formula Elements in a CSV File
There is a CSV injection vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could build malicious data to generate executable commands in the CSV file.
- 7.8 High severity
autolabel: Improper Neutralization of Formula Elements in a CSV File
An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a maliciousl