Improper Neutralization of Formula Elements in a CSV File
CWE-1236
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
We track 107 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.5.
How this weakness is prevented
- Implementation: When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
- Implementation: If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
- Architecture and Design: Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.
Latest Improper Neutralization of Formula Elements in a CSV File vulnerabilities
- 7.8 High severity
MetForm – Contact Form, Survey, Quiz, & Custom…: Improper Neutralization of Formula Elements in a CSV File
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution w
- 8.8 High severity
Minical: Improper Neutralization of Formula Elements in a CSV File
Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on the Customer Name field in the Accounting module that is used to construct a CSV
- 7.8 High severity
Churchcrm: Improper Neutralization of Formula Elements in a CSV File
ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file.
- 7.3 High severity
FortiAnalyzer: Improper Neutralization of Formula Elements in a CSV File
A improper neutralization of formula elements in a CSV file vulnerability in Fortinet FortiAnalyzer 6.4.0 - 6.4.9, 7.0.0 - 7.0.5, and 7.2.0 - 7.2.1 allows local attacker to execute unauthorized code or commands via inserting spreadsheet formulas in macro names
- 8.8 High severity
Maximo Asset Management: Improper Neutralization of Formula Elements in a CSV File
IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and the IBM Maximo Manage 8.3, 8.4 application in IBM Maximo Application Suite are vulnerable to CSV injection. IBM X-Force ID: 2306335.
- 8.8 High severity
Aruba Mobility Conductor (formerly Mobility…: Improper Neutralization of Formula Elements in a CSV File
Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system
- 7.8 High severity
Appointment Hour Booking – Booking Calendar: Improper Neutralization of Formula Elements in a CSV File
The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation that may be exported a
- 8.0 High severity
MAILD Mail Server: Improper Neutralization of Formula Elements in a CSV File
A remote attacker with general user privilege can inject malicious code in the form content of Raiden MAILD Mail Server website. Other users export form content as CSV file can trigger arbitrary code execution and allow the attacker to perform arbitrary system
- 7.8 High severity
Event Registration Application: Improper Neutralization of Formula Elements in a CSV File
Sourcecodester Event Registration App v1.0 was discovered to contain multiple CSV injection vulnerabilities via the First Name, Contact and Remarks fields. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file.
- 9.8 Critical severity
Contact Form Plugin – Fastest Contact Form…: Improper Neutralization of Formula Elements in a CSV File
The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection
- 9.8 Critical severity
IBM InfoSphere Information Server: Improper Neutralization of Formula Elements in a CSV File
"IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 223598."
- 8.8 High severity
PHP Point of Sale: Improper Neutralization of Formula Elements in a CSV File
The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within export data and then triggered in exported data viewers.
- 8.0 High severity
Zkbio Time: Improper Neutralization of Formula Elements in a CSV File
ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20220721.14829 was discovered to contain a CSV injection vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the Content text field of the
- 8.0 High severity
Espocrm: Improper Neutralization of Formula Elements in a CSV File
CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. Admin user exporting contacts in CSV file may end up executing the malicious sy
- 8.0 High severity
Affiliates Manager: Improper Neutralization of Formula Elements in a CSV File
The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection attacks against an admin exporting the data
- 8.8 High severity
Mobile Events Manager: Improper Neutralization of Formula Elements in a CSV File
The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability.
- 8.8 High severity
WP Users Exporter: Improper Neutralization of Formula Elements in a CSV File
The WP Users Exporter plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.2 via the 'Export Users' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into profil
- 8.0 High severity
Ultimate SMS Notifications for WooCommerce: Improper Neutralization of Formula Elements in a CSV File
The Ultimate SMS Notifications for WooCommerce plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.1 via the 'Export Utility' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add
- 8.8 High severity
Request a Quote: Improper Neutralization of Formula Elements in a CSV File
The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it
- 8.8 High severity
Exports and Reports: Improper Neutralization of Formula Elements in a CSV File
The Exports and Reports WordPress plugin before 0.9.2 does not sanitize and validate data when generating the CSV to export, which could lead to a CSV injection, by the use of Microsoft Excel DDE function, or to leak data via maliciously injected hyperlinks.
- 7.8 High severity
WP-CRM – Customer Relations Management for…: Improper Neutralization of Formula Elements in a CSV File
The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability.
- 8.0 High severity
PowerStore: Improper Neutralization of Formula Elements in a CSV File
PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file. The data is taken as is, without any validation or sanitization. It allows a malicious, authenticated user to inject payloads that might get interpreted as formulas by t
- 7.8 High severity
luyadev/yii-helpers: Improper Neutralization of Formula Elements in a CSV File
Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remot
- 9.8 Critical severity
Visual Form Builder: Improper Neutralization of Formula Elements in a CSV File
The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.
- 9.8 Critical severity
Surveyking: Improper Neutralization of Formula Elements in a CSV File
Survey King v0.3.0 does not filter data properly when exporting excel files, allowing attackers to execute arbitrary code or access sensitive information via a CSV injection attack.
- 8.8 High severity
gradio: Improper Neutralization of Formula Elements in a CSV File
`gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutralization of Formula Elements in a CSV File. The `gradio` library has a flagging functionality which s
- 8.8 High severity
CA Harvest Software Change Manager: Improper Neutralization of Formula Elements in a CSV File
CA Harvest Software Change Manager versions 13.0.3, 13.0.4, 14.0.0, and 14.0.1, contain a vulnerability in the CSV export functionality, due to insufficient input validation, that can allow a privileged user to potentially execute arbitrary code or commands.