Common Weakness Enumeration
CWE-1236
AllowedImproper Neutralization of Formula Elements in a CSV File
Abstraction: Base · Status: Incomplete
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
402 vulnerabilities reference this CWE, most recent first.
GHSA-634P-93H9-92VH
Vulnerability from github – Published: 2022-09-16 22:06 – Updated: 2022-09-19 20:20
VLAI
Summary
ghas-to-csv vulnerable to Improper Neutralization of Formula Elements in a CSV File
Details
Impact
This GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom field contains executable code / formulas, it might be run when an endpoint opens that CSV file in a spreadsheet program. The data flow looks like this 👇🏻
graph TD
A(Repository) -->|developer dismissal, other data input| B(GitHub Advanced Security data)
B -->|ghas-to-csv| C(CSV file)
C -->|spreadsheet program| D(endpoint executes potentially malicious code)
Patches
Please use version v1 or later. That tag moves from using csv to defusedcsv to mitigate this problem.
Workarounds
There is no workaround. Please upgrade to using the latest tag, v1 (or later).
References
- CWE-1236 information from MITRE
- CSV injection information from OWASP
- CodeQL query for CWE-1236 in Python here
- PyPI site for
defusedcsvhere
For more information
If you have any questions or comments about this advisory:
- Open an issue in this repository here
Severity
5.8 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "GitHub Actions",
"name": "some-natalie/ghas-to-csv"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-39217"
],
"database_specific": {
"cwe_ids": [
"CWE-1236",
"CWE-74"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-16T22:06:55Z",
"nvd_published_at": "2022-09-17T00:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nThis GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom field contains executable code / formulas, it might be run when an endpoint opens that CSV file in a spreadsheet program. The data flow looks like this \ud83d\udc47\ud83c\udffb \n\n```mermaid\ngraph TD\n A(Repository) --\u003e|developer dismissal, other data input| B(GitHub Advanced Security data)\n B --\u003e|ghas-to-csv| C(CSV file)\n C --\u003e|spreadsheet program| D(endpoint executes potentially malicious code)\n```\n\n### Patches\n\nPlease use version `v1` or later. That tag moves from using `csv` to `defusedcsv` to mitigate this problem.\n\n### Workarounds\n\nThere is no workaround. Please upgrade to using the latest tag, `v1` (or later).\n\n### References\n\n* CWE-1236 information from [MITRE](https://cwe.mitre.org/data/definitions/1236.html)\n* CSV injection information from [OWASP](https://owasp.org/www-community/attacks/CSV_Injection)\n* CodeQL query for CWE-1236 in Python [here](https://github.com/github/codeql/tree/main/python/ql/src/experimental/Security/CWE-1236)\n* PyPI site for `defusedcsv` [here](https://pypi.org/project/defusedcsv/)\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in this repository [here](https://github.com/some-natalie/ghas-to-csv/issues)\n",
"id": "GHSA-634p-93h9-92vh",
"modified": "2022-09-19T20:20:23Z",
"published": "2022-09-16T22:06:55Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/some-natalie/ghas-to-csv/security/advisories/GHSA-634p-93h9-92vh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39217"
},
{
"type": "WEB",
"url": "https://github.com/some-natalie/ghas-to-csv/issues/19"
},
{
"type": "WEB",
"url": "https://github.com/some-natalie/ghas-to-csv/pull/20"
},
{
"type": "WEB",
"url": "https://github.com/some-natalie/ghas-to-csv/commit/d0b521928fa734513b5cd9c7d9d8e09db50e884a"
},
{
"type": "PACKAGE",
"url": "https://github.com/some-natalie/ghas-to-csv"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "ghas-to-csv vulnerable to Improper Neutralization of Formula Elements in a CSV File"
}
GHSA-639R-6P24-C5MM
Vulnerability from github – Published: 2022-05-24 17:46 – Updated: 2022-05-24 17:46
VLAI
Details
Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and link injection attacks on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
{
"affected": [],
"aliases": [
"CVE-2021-1475"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-08T04:15:00Z",
"severity": "MODERATE"
},
"details": "Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and link injection attacks on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.",
"id": "GHSA-639r-6p24-c5mm",
"modified": "2022-05-24T17:46:52Z",
"published": "2022-05-24T17:46:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1475"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-umbrella-inject-gbZGHP5T"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-64FQ-9C6W-RQ44
Vulnerability from github – Published: 2022-04-09 00:00 – Updated: 2022-04-22 20:21
VLAI
Summary
Improper Neutralization of Formula Elements in a CSV File in Kimai 2
Details
A CSV Injection vulnerablity exists in Kimai Kimai 2 prior to 1.14.1 via a description in a new timesheet.
Severity
7.8 (High)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "kevinpapst/kimai2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-43515"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": true,
"github_reviewed_at": "2022-04-22T20:21:47Z",
"nvd_published_at": "2022-04-08T17:15:00Z",
"severity": "HIGH"
},
"details": "A CSV Injection vulnerablity exists in Kimai Kimai 2 prior to 1.14.1 via a description in a new timesheet.",
"id": "GHSA-64fq-9c6w-rq44",
"modified": "2022-04-22T20:21:47Z",
"published": "2022-04-09T00:00:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43515"
},
{
"type": "WEB",
"url": "https://github.com/kevinpapst/kimai2/pull/2532"
},
{
"type": "WEB",
"url": "https://github.com/kevinpapst/kimai2/commit/dad1b8b772947f1596175add1b4f33b791705507#diff-6774f5865dbaf8bc6c55b75bd92e6f9950ebe7834aa2efd828a19fd637e667cf"
},
{
"type": "PACKAGE",
"url": "https://github.com/kevinpapst/kimai2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Neutralization of Formula Elements in a CSV File in Kimai 2"
}
GHSA-658Q-F487-R8H7
Vulnerability from github – Published: 2025-02-19 18:32 – Updated: 2025-02-19 18:32
VLAI
Details
IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0
could allow an authenticated attacker to conduct formula injection. An attacker could execute arbitrary commands on the system, caused by improper validation of file contents.
Severity
8.0 (High)
{
"affected": [],
"aliases": [
"CVE-2024-45084"
],
"database_specific": {
"cwe_ids": [
"CWE-1236",
"CWE-502"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-19T16:15:39Z",
"severity": "HIGH"
},
"details": "IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 \n\ncould allow an authenticated attacker to conduct formula injection. An attacker could execute arbitrary commands on the system, caused by improper validation of file contents.",
"id": "GHSA-658q-f487-r8h7",
"modified": "2025-02-19T18:32:23Z",
"published": "2025-02-19T18:32:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45084"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7183597"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-65HP-4VXR-C356
Vulnerability from github – Published: 2022-02-12 00:00 – Updated: 2022-02-23 21:53
VLAI
Summary
Arbitrary code execution in Magnolia CMS
Details
An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted CSV/XLS file.
Severity
7.8 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "info.magnolia:magnolia-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.2.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-46363"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": true,
"github_reviewed_at": "2022-02-14T22:43:59Z",
"nvd_published_at": "2022-02-11T21:15:00Z",
"severity": "HIGH"
},
"details": "An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted CSV/XLS file.",
"id": "GHSA-65hp-4vxr-c356",
"modified": "2022-02-23T21:53:30Z",
"published": "2022-02-12T00:00:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46363"
},
{
"type": "WEB",
"url": "https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory"
},
{
"type": "WEB",
"url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46363-Formula%20Injection-Magnolia%20CMS"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Arbitrary code execution in Magnolia CMS"
}
GHSA-663J-RJCR-789F
Vulnerability from github – Published: 2021-09-30 20:50 – Updated: 2024-10-23 18:35
VLAI
Summary
CSV injection in shuup
Details
“Shuup” application in versions 0.4.2 to 2.10.8 is affected by the “Formula Injection” vulnerability. A customer can inject payloads in the name input field in the billing address while buying a product. When a store administrator accesses the reports page to export the data as an Excel file and opens it, the payload gets executed.
Severity
8.0 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "shuup"
},
"ranges": [
{
"events": [
{
"introduced": "0.4.2"
},
{
"fixed": "2.11.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-25962"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": true,
"github_reviewed_at": "2021-09-30T18:33:24Z",
"nvd_published_at": "2021-09-29T14:15:00Z",
"severity": "HIGH"
},
"details": "\u201cShuup\u201d application in versions 0.4.2 to 2.10.8 is affected by the \u201cFormula Injection\u201d vulnerability. A customer can inject payloads in the name input field in the billing address while buying a product. When a store administrator accesses the reports page to export the data as an Excel file and opens it, the payload gets executed.",
"id": "GHSA-663j-rjcr-789f",
"modified": "2024-10-23T18:35:09Z",
"published": "2021-09-30T20:50:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25962"
},
{
"type": "WEB",
"url": "https://github.com/shuup/shuup/commit/0a2db392e8518410c282412561461cd8797eea51"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/shuup/PYSEC-2021-355.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/shuup/shuup"
},
{
"type": "WEB",
"url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25962"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "CSV injection in shuup"
}
GHSA-66X9-9JM6-JRG4
Vulnerability from github – Published: 2022-03-11 00:02 – Updated: 2022-03-23 00:00
VLAI
Details
IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by spreadsheet software. IBM X-Force ID: 213858.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2021-39022"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-10T20:15:00Z",
"severity": "HIGH"
},
"details": "IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by spreadsheet software. IBM X-Force ID: 213858.",
"id": "GHSA-66x9-9jm6-jrg4",
"modified": "2022-03-23T00:00:56Z",
"published": "2022-03-11T00:02:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39022"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/213858"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6562379"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-674M-H5XX-V6GP
Vulnerability from github – Published: 2023-11-17 15:30 – Updated: 2025-09-29 15:30
VLAI
Details
Corebos 8.0 and below is vulnerable to CSV Injection. An attacker with low privileges can inject a malicious command into a table. This vulnerability is exploited when an administrator visits the user management section, exports the data to a CSV file, and then opens it, leading to the execution of the malicious payload on the administrator's computer.
Severity
8.0 (High)
{
"affected": [],
"aliases": [
"CVE-2023-48029"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-17T13:15:09Z",
"severity": "HIGH"
},
"details": "Corebos 8.0 and below is vulnerable to CSV Injection. An attacker with low privileges can inject a malicious command into a table. This vulnerability is exploited when an administrator visits the user management section, exports the data to a CSV file, and then opens it, leading to the execution of the malicious payload on the administrator\u0027s computer.",
"id": "GHSA-674m-h5xx-v6gp",
"modified": "2025-09-29T15:30:29Z",
"published": "2023-11-17T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48029"
},
{
"type": "WEB",
"url": "https://gist.github.com/bugplorer/09d312373066a3b72996ebd76a7a23a5"
},
{
"type": "WEB",
"url": "https://nitipoom-jar.github.io/CVE-2023-48029"
},
{
"type": "WEB",
"url": "https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-48029"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-67VV-JV7V-RM85
Vulnerability from github – Published: 2023-06-22 12:30 – Updated: 2024-04-04 05:00
VLAI
Details
Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection.
Severity
7.2 (High)
{
"affected": [],
"aliases": [
"CVE-2023-31867"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-22T12:15:11Z",
"severity": "HIGH"
},
"details": "Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection.",
"id": "GHSA-67vv-jv7v-rm85",
"modified": "2024-04-04T05:00:29Z",
"published": "2023-06-22T12:30:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31867"
},
{
"type": "WEB",
"url": "https://github.com/Digitemis/Advisory/blob/main/CVE-2023-31867.txt"
},
{
"type": "WEB",
"url": "http://sage.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-68XC-XQW9-7X6F
Vulnerability from github – Published: 2022-05-24 17:10 – Updated: 2022-05-24 17:10
VLAI
Details
The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.
{
"affected": [],
"aliases": [
"CVE-2020-9372"
],
"database_specific": {
"cwe_ids": [
"CWE-1236",
"CWE-74"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-03-04T19:15:00Z",
"severity": "MODERATE"
},
"details": "The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.",
"id": "GHSA-68xc-xqw9-7x6f",
"modified": "2022-05-24T17:10:09Z",
"published": "2022-05-24T17:10:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9372"
},
{
"type": "WEB",
"url": "https://drive.google.com/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/appointment-booking-calendar/#developers"
},
{
"type": "WEB",
"url": "https://www.hotdreamweaver.com/support/view.php?id=815925"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/156694/WordPress-Appointment-Booking-Calendar-1.3.34-CSV-Injection.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Implementation
When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
Mitigation
Implementation
If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
Mitigation
Architecture and Design
Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.
No CAPEC attack patterns related to this CWE.