CWE-1236
AllowedImproper Neutralization of Formula Elements in a CSV File
Abstraction: Base · Status: Incomplete
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
440 vulnerabilities reference this CWE, most recent first.
GHSA-FH47-7RX2-5CFR
Vulnerability from github – Published: 2022-05-13 01:19 – Updated: 2022-05-13 01:19The Export Users to CSV plugin through 1.1.1 for WordPress allows CSV injection.
{
"affected": [],
"aliases": [
"CVE-2018-15571"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-28T17:29:00Z",
"severity": "HIGH"
},
"details": "The Export Users to CSV plugin through 1.1.1 for WordPress allows CSV injection.",
"id": "GHSA-fh47-7rx2-5cfr",
"modified": "2022-05-13T01:19:10Z",
"published": "2022-05-13T01:19:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15571"
},
{
"type": "WEB",
"url": "https://hackpuntes.com/cve-2018-15571-wordpress-plugin-export-users-to-csv-1-1-1-csv-injection"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/45206"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FMJC-6X9Q-54MF
Vulnerability from github – Published: 2025-11-18 12:30 – Updated: 2025-11-18 12:30The Simple User Import Export plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.1.7 via the 'Import/export users' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration
{
"affected": [],
"aliases": [
"CVE-2025-13133"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-18T10:15:49Z",
"severity": "MODERATE"
},
"details": "The Simple User Import Export plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.1.7 via the \u0027Import/export users\u0027 function. This makes it possible for authenticated attackers, with Administrator-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration",
"id": "GHSA-fmjc-6x9q-54mf",
"modified": "2025-11-18T12:30:18Z",
"published": "2025-11-18T12:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13133"
},
{
"type": "WEB",
"url": "https://it.wordpress.org/plugins/a3-user-importer"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/39ec49b4-f0f3-4ec7-b11b-ce808c025577?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-FPX6-QJ6W-4M83
Vulnerability from github – Published: 2024-01-16 18:31 – Updated: 2025-06-11 18:35The Contact Form Entries WordPress plugin before 1.3.0 does not validate data when its output in a CSV file, which could lead to CSV injection.
{
"affected": [],
"aliases": [
"CVE-2022-3604"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-16T16:15:09Z",
"severity": "HIGH"
},
"details": "The Contact Form Entries WordPress plugin before 1.3.0 does not validate data when its output in a CSV file, which could lead to CSV injection.",
"id": "GHSA-fpx6-qj6w-4m83",
"modified": "2025-06-11T18:35:38Z",
"published": "2024-01-16T18:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3604"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/300ebfcd-c500-464e-b919-acfeb72593de"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FQMJ-V992-7VW6
Vulnerability from github – Published: 2025-08-29 03:30 – Updated: 2025-08-29 03:30There is a CSV Injection Vulnerability in some HikCentral Master Lite versions. This could allow an attacker to inject executable commands via malicious CSV data.
{
"affected": [],
"aliases": [
"CVE-2025-39245"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-29T03:15:38Z",
"severity": "MODERATE"
},
"details": "There is a CSV Injection Vulnerability in some HikCentral Master Lite versions. This could allow an attacker to inject executable commands via malicious CSV data.",
"id": "GHSA-fqmj-v992-7vw6",
"modified": "2025-08-29T03:30:51Z",
"published": "2025-08-29T03:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39245"
},
{
"type": "WEB",
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-some-hikcentral-products"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-FVQ4-C84W-Q2RX
Vulnerability from github – Published: 2022-05-24 17:36 – Updated: 2026-07-05 03:30OpenAsset Digital Asset Management (DAM) 12.0.19 and earlier failed to implement access controls on /Stream/ProjectsCSV endpoint, allowing unauthenticated attackers to gain access to potentially sensitive project information stored by the application.
{
"affected": [],
"aliases": [
"CVE-2020-28861"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-14T20:15:00Z",
"severity": "MODERATE"
},
"details": "OpenAsset Digital Asset Management (DAM) 12.0.19 and earlier failed to implement access controls on /Stream/ProjectsCSV endpoint, allowing unauthenticated attackers to gain access to potentially sensitive project information stored by the application.",
"id": "GHSA-fvq4-c84w-q2rx",
"modified": "2026-07-05T03:30:39Z",
"published": "2022-05-24T17:36:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28861"
},
{
"type": "WEB",
"url": "https://www.themissinglink.com.au/security-advisories-cve-2020-28861"
},
{
"type": "WEB",
"url": "http://openasset.com"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/160457/OpenAsset-Digital-Asset-Management-Insecure-Direct-Object-Reference.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Dec/22"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FWF6-RW69-HHJ4
Vulnerability from github – Published: 2021-11-30 22:22 – Updated: 2024-09-20 21:51This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a malicious link or execute commands via CSV files.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "html-to-csv"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23654"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": true,
"github_reviewed_at": "2021-11-29T20:28:01Z",
"nvd_published_at": "2021-11-26T20:15:00Z",
"severity": "MODERATE"
},
"details": "This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a malicious link or execute commands via CSV files.",
"id": "GHSA-fwf6-rw69-hhj4",
"modified": "2024-09-20T21:51:03Z",
"published": "2021-11-30T22:22:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23654"
},
{
"type": "WEB",
"url": "https://github.com/hanwentao/html2csv/issues/9"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-fwf6-rw69-hhj4"
},
{
"type": "PACKAGE",
"url": "https://github.com/hanwentao/html2csv"
},
{
"type": "WEB",
"url": "https://github.com/hanwentao/html2csv/blob/master/html2csv/converter.py"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/html-to-csv/PYSEC-2021-866.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-HTMLTOCSV-1582784"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Improper Neutralization of Formula Elements in a CSV File in html-2-csv"
}
GHSA-FWH8-67C4-8CGG
Vulnerability from github – Published: 2026-08-18 18:31 – Updated: 2026-08-21 21:31CSV export functionality in Brainstorm Force SureForms version, <= 2.1.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on an administrator's workstation when the exported CSV file is opened in a vulnerable spreadsheet application.
{
"affected": [],
"aliases": [
"CVE-2026-19501"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-18T16:17:02Z",
"severity": "HIGH"
},
"details": "CSV export functionality in Brainstorm Force SureForms version, \u003c= 2.1.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on an administrator\u0027s workstation when the exported CSV file is opened in a vulnerable spreadsheet application.",
"id": "GHSA-fwh8-67c4-8cgg",
"modified": "2026-08-21T21:31:41Z",
"published": "2026-08-18T18:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19501"
},
{
"type": "WEB",
"url": "https://github.com/typedefabcd1234ntd/CVE-2026-19501-poc"
},
{
"type": "WEB",
"url": "http://sureforms.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FX25-QH4F-8GHH
Vulnerability from github – Published: 2025-07-31 09:32 – Updated: 2025-07-31 09:32Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user's environment, the embedded code may be executed.
{
"affected": [],
"aliases": [
"CVE-2025-54752"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T08:15:25Z",
"severity": "MODERATE"
},
"details": "Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user\u0027s environment, the embedded code may be executed.",
"id": "GHSA-fx25-qh4f-8ghh",
"modified": "2025-07-31T09:32:49Z",
"published": "2025-07-31T09:32:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54752"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU93412964"
},
{
"type": "WEB",
"url": "https://www.powercms.jp/news/release-powercms-671-531-461.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-G26Q-PPP8-JJ4R
Vulnerability from github – Published: 2022-05-24 17:43 – Updated: 2022-05-24 17:43A CSV injection vulnerability found in Online Invoicing System (OIS) 4.3 and below can be exploited by users to perform malicious actions such as redirecting admins to unknown or harmful websites, or disclosing other clients' details that the user did not have access to.
{
"affected": [],
"aliases": [
"CVE-2021-27839"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-03T19:15:00Z",
"severity": "MODERATE"
},
"details": "A CSV injection vulnerability found in Online Invoicing System (OIS) 4.3 and below can be exploited by users to perform malicious actions such as redirecting admins to unknown or harmful websites, or disclosing other clients\u0027 details that the user did not have access to.",
"id": "GHSA-g26q-ppp8-jj4r",
"modified": "2022-05-24T17:43:36Z",
"published": "2022-05-24T17:43:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27839"
},
{
"type": "WEB",
"url": "https://github.com/bigprof-software/online-invoicing-system/releases/tag/4.4"
},
{
"type": "WEB",
"url": "https://www.jinsonvarghese.com/csv-injection-in-online-invoicing-system"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-G27C-Q7CP-MHX6
Vulnerability from github – Published: 2026-05-28 06:31 – Updated: 2026-07-01 21:25Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "json-2-csv"
},
"ranges": [
{
"events": [
{
"introduced": "3.15.0"
},
{
"fixed": "5.5.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-9673"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-01T21:25:23Z",
"nvd_published_at": "2026-05-28T06:16:29Z",
"severity": "MODERATE"
},
"details": "Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications.",
"id": "GHSA-g27c-q7cp-mhx6",
"modified": "2026-07-01T21:25:23Z",
"published": "2026-05-28T06:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9673"
},
{
"type": "WEB",
"url": "https://github.com/mrodrig/json-2-csv/commit/0fdd0bb6d0273178cd940afc323ccbce19688229"
},
{
"type": "WEB",
"url": "https://gist.github.com/whoamins/299745a2d36b482b44e9613b78e40613"
},
{
"type": "PACKAGE",
"url": "https://github.com/mrodrig/json-2-csv"
},
{
"type": "WEB",
"url": "https://github.com/mrodrig/json-2-csv/blob/main/src/json2csv.ts%23L410"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSON2CSV-14221326"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio"
}
Mitigation
When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
Mitigation
If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
Mitigation
Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.
No CAPEC attack patterns related to this CWE.