CWE-1236
AllowedImproper Neutralization of Formula Elements in a CSV File
Abstraction: Base · Status: Incomplete
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
440 vulnerabilities reference this CWE, most recent first.
GHSA-67VV-JV7V-RM85
Vulnerability from github – Published: 2023-06-22 12:30 – Updated: 2024-04-04 05:00Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection.
{
"affected": [],
"aliases": [
"CVE-2023-31867"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-22T12:15:11Z",
"severity": "HIGH"
},
"details": "Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection.",
"id": "GHSA-67vv-jv7v-rm85",
"modified": "2024-04-04T05:00:29Z",
"published": "2023-06-22T12:30:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31867"
},
{
"type": "WEB",
"url": "https://github.com/Digitemis/Advisory/blob/main/CVE-2023-31867.txt"
},
{
"type": "WEB",
"url": "http://sage.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-68XC-XQW9-7X6F
Vulnerability from github – Published: 2022-05-24 17:10 – Updated: 2022-05-24 17:10The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.
{
"affected": [],
"aliases": [
"CVE-2020-9372"
],
"database_specific": {
"cwe_ids": [
"CWE-1236",
"CWE-74"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-03-04T19:15:00Z",
"severity": "MODERATE"
},
"details": "The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.",
"id": "GHSA-68xc-xqw9-7x6f",
"modified": "2022-05-24T17:10:09Z",
"published": "2022-05-24T17:10:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9372"
},
{
"type": "WEB",
"url": "https://drive.google.com/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/appointment-booking-calendar/#developers"
},
{
"type": "WEB",
"url": "https://www.hotdreamweaver.com/support/view.php?id=815925"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/156694/WordPress-Appointment-Booking-Calendar-1.3.34-CSV-Injection.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6C4H-J469-9CV8
Vulnerability from github – Published: 2022-05-24 22:00 – Updated: 2023-02-23 03:30CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees feature.
{
"affected": [],
"aliases": [
"CVE-2019-16120"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-09-08T23:15:00Z",
"severity": "MODERATE"
},
"details": "CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the \"All Post\u003e Ticketed \u003e Attendees\" Export Attendees feature.",
"id": "GHSA-6c4h-j469-9cv8",
"modified": "2023-02-23T03:30:16Z",
"published": "2022-05-24T22:00:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16120"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/event-tickets/#developers"
},
{
"type": "WEB",
"url": "https://wpvulndb.com/vulnerabilities/9858"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/47335"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6GJ9-93MW-92FP
Vulnerability from github – Published: 2022-05-13 01:19 – Updated: 2022-05-13 01:19OPSWAT MetaDefender before v4.11.2 allows CSV injection.
{
"affected": [],
"aliases": [
"CVE-2018-16275"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-31T13:29:00Z",
"severity": "HIGH"
},
"details": "OPSWAT MetaDefender before v4.11.2 allows CSV injection.",
"id": "GHSA-6gj9-93mw-92fp",
"modified": "2022-05-13T01:19:14Z",
"published": "2022-05-13T01:19:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16275"
},
{
"type": "WEB",
"url": "https://onlinehelp.opswat.com/corev4/10._Release_notes.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6GJQ-VMWG-37PV
Vulnerability from github – Published: 2022-01-11 00:00 – Updated: 2025-08-26 21:30In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can create a new table to inject payloads in the table rows. When an administrator accesses the User Management endpoint and exports the data as a CSV file and opens it, the payload gets executed.
{
"affected": [],
"aliases": [
"CVE-2022-22121"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-10T16:15:00Z",
"severity": "HIGH"
},
"details": "In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can create a new table to inject payloads in the table rows. When an administrator accesses the User Management endpoint and exports the data as a CSV file and opens it, the payload gets executed.",
"id": "GHSA-6gjq-vmwg-37pv",
"modified": "2025-08-26T21:30:54Z",
"published": "2022-01-11T00:00:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22121"
},
{
"type": "WEB",
"url": "https://github.com/nocodb/nocodb/commit/079e3abe"
},
{
"type": "WEB",
"url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22121"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6M2G-5GF8-CV5J
Vulnerability from github – Published: 2025-09-08 18:31 – Updated: 2025-09-08 21:30A CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel file.
{
"affected": [],
"aliases": [
"CVE-2025-56267"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-08T18:15:34Z",
"severity": "CRITICAL"
},
"details": "A CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel file.",
"id": "GHSA-6m2g-5gf8-cv5j",
"modified": "2025-09-08T21:30:59Z",
"published": "2025-09-08T18:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-56267"
},
{
"type": "WEB",
"url": "https://github.com/nikolas-ch/CVEs/blob/main/AvigilonACM_v7.10.0.20/CSV_Injection/CSV_Injection.txt"
},
{
"type": "WEB",
"url": "https://github.com/nikolas-ch/CVEs/tree/main/AvigilonACM_v7.10.0.20"
},
{
"type": "WEB",
"url": "https://github.com/nikolas-ch/CVEs/tree/main/AvigilonACM_v7.10.0.20/CSV_Injection"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6MR8-2XXJ-PR7J
Vulnerability from github – Published: 2022-05-24 16:47 – Updated: 2023-01-30 18:30An issue was discovered in Joomla! before 3.9.7. The CSV export of com_actionslogs is vulnerable to CSV injection.
{
"affected": [],
"aliases": [
"CVE-2019-12765"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-11T19:29:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in Joomla! before 3.9.7. The CSV export of com_actionslogs is vulnerable to CSV injection.",
"id": "GHSA-6mr8-2xxj-pr7j",
"modified": "2023-01-30T18:30:30Z",
"published": "2022-05-24T16:47:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12765"
},
{
"type": "WEB",
"url": "https://developer.joomla.org/security-centre/783-20190601-core-csv-injection-in-com-actionlogs"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/108736"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6MXJ-JJJJ-8MPV
Vulnerability from github – Published: 2022-11-14 19:00 – Updated: 2022-11-17 03:30The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection.
{
"affected": [],
"aliases": [
"CVE-2022-3574"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-14T15:15:00Z",
"severity": "CRITICAL"
},
"details": "The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection.",
"id": "GHSA-6mxj-jjjj-8mpv",
"modified": "2022-11-17T03:30:53Z",
"published": "2022-11-14T19:00:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3574"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/0eae5189-81af-4344-9e96-dd1f4e223d41"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6PC6-7FMG-34VV
Vulnerability from github – Published: 2025-02-20 18:31 – Updated: 2025-11-04 21:31PHPJabbers Cinema Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Options that is used to construct CSV file.
{
"affected": [],
"aliases": [
"CVE-2023-51333"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-20T18:15:24Z",
"severity": "HIGH"
},
"details": "PHPJabbers Cinema Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Options that is used to construct CSV file.",
"id": "GHSA-6pc6-7fmg-34vv",
"modified": "2025-11-04T21:31:30Z",
"published": "2025-02-20T18:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51333"
},
{
"type": "WEB",
"url": "https://packetstorm.news/files/id/176511"
},
{
"type": "WEB",
"url": "https://www.phpjabbers.com/cinema-booking-system/#sectionDemo"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/176511/PHPJabbers-Cinema-Booking-System-1.0-CSV-Injection.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6Q72-8PQ4-4XPR
Vulnerability from github – Published: 2022-02-11 00:01 – Updated: 2022-02-11 00:01CA Harvest Software Change Manager versions 13.0.3, 13.0.4, 14.0.0, and 14.0.1, contain a vulnerability in the CSV export functionality, due to insufficient input validation, that can allow a privileged user to potentially execute arbitrary code or commands.
{
"affected": [],
"aliases": [
"CVE-2022-22689"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-04T23:15:00Z",
"severity": "HIGH"
},
"details": "CA Harvest Software Change Manager versions 13.0.3, 13.0.4, 14.0.0, and 14.0.1, contain a vulnerability in the CSV export functionality, due to insufficient input validation, that can allow a privileged user to potentially execute arbitrary code or commands.",
"id": "GHSA-6q72-8pq4-4xpr",
"modified": "2022-02-11T00:01:17Z",
"published": "2022-02-11T00:01:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22689"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/security-advisory/content/security-advisories/CA20220203-01-Security-Notice-for-CA-Harvest-Software-Change-Manager/ESDSA20297"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
Mitigation
If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
Mitigation
Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.
No CAPEC attack patterns related to this CWE.