Common Weakness Enumeration
CWE-1236
Weakness AllowedImproper Neutralization of Formula Elements in a CSV File
Abstraction: Base · Status: Incomplete
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Modes of introduction
Implementation
The weakness is in the implementation of a software's CSV export feature, in particular how it formats formula entries as the output gets flattened into a text file.
Detection methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Content history
Submission: CWE Content Team
· MITRE
· 2019-11-21
· CWE 4.0
Modification: CWE Content Team
· MITRE
· 2020-08-20
· CWE 4.2
updated Relationships
Modification: CWE Content Team
· MITRE
· 2021-03-15
· CWE 4.4
updated Description, Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2023-01-31
· CWE 4.10
updated Description
Modification: CWE Content Team
· MITRE
· 2023-04-27
· CWE 4.11
updated References, Relationships
Modification: CWE Content Team
· MITRE
· 2023-06-29
· CWE 4.12
updated Mapping_Notes
Modification: CWE Content Team
· MITRE
· 2025-04-03
· CWE 4.17
updated Demonstrative_Examples
Modification: CWE Content Team
· MITRE
· 2025-09-09
· CWE 4.18
updated References
Modification: CWE Content Team
· MITRE
· 2025-12-11
· CWE 4.19
updated Background_Details, Common_Consequences, Description, Detection_Factors, Weakness_Ordinalities
462 vulnerabilities reference this CWE, most recent first.
CVE-2026-129133 (GCVE-0-2026-129133)
Vulnerability from cvelistv5 – Published: 2026-11-13 16:23 – Updated: 2026-11-13 16:23
VLAI
EPSS
VEX
Title
MRBS before 1.13.0 CSV Formula Injection via Report Export
Summary
MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape() function in web/report.php fails to neutralize leading formula characters. Attackers can store formulas in booking names, descriptions or custom fields that execute when privileged users open exported CSV reports, enabling data exfiltration or command execution via DDE.
Severity
5.4 (Medium)
CWE
- CWE-1236 - Improper Neutralization of Formula Elements in a CSV File
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/meeting-room-booking-system/mr… | vendor-advisory |
| https://github.com/meeting-room-booking-system/mr… | patch |
| https://github.com/meeting-room-booking-system/mr… | release-notes |
| https://github.com/meeting-room-booking-system/mr… | technical-description |
| https://www.vulncheck.com/advisories/mrbs-before-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| meeting-room-booking-system | mrbs-code |
Affected:
0 , < 1.13.0
(semver)
|
Date Public
2026-11-12 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/meeting-room-booking-system/mrbs-code",
"product": "mrbs-code",
"vendor": "meeting-room-booking-system",
"versions": [
{
"lessThan": "1.13.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "leediay153 from Viettel Post"
},
{
"lang": "en",
"type": "remediation developer",
"value": "John Beranek"
}
],
"datePublic": "2026-11-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape() function in web/report.php fails to neutralize leading formula characters. Attackers can store formulas in booking names, descriptions or custom fields that execute when privileged users open exported CSV reports, enabling data exfiltration or command execution via DDE."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "Improper Neutralization of Formula Elements in a CSV File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T16:23:35.501Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-9rvp-v4ff-wpwr)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-9rvp-v4ff-wpwr"
},
{
"tags": [
"patch"
],
"url": "https://github.com/meeting-room-booking-system/mrbs-code/commit/92f6f5610072ddb9e1b38074c410fc8be56947ed"
},
{
"name": "mrbs-code v1.13.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.13.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/meeting-room-booking-system/mrbs-code/blob/299686ed64174a66448699f5ca0fb5e0e0ea9faa/web/report.php#L542-L543"
},
{
"name": "VulnCheck Advisory: MRBS before 1.13.0 CSV Formula Injection via Report Export",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/mrbs-before-1.13.0-csv-formula-injection-via-report-export"
}
],
"title": "MRBS before 1.13.0 CSV Formula Injection via Report Export",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129133",
"datePublished": "2026-11-13T16:23:35.501Z",
"dateReserved": "2026-11-13T16:01:04.407Z",
"dateUpdated": "2026-11-13T16:23:35.501Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126289 (GCVE-0-2026-126289)
Vulnerability from cvelistv5 – Published: 2026-11-13 09:36 – Updated: 2026-11-13 09:36
VLAI
EPSS
VEX
Title
NocoDB before 2026.06.1 CSV Formula Injection via export.service.ts
Summary
NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values and column titles beginning with formula characters into CSV exports without neutralization. Low-privileged collaborators, or unauthenticated users submitting a public form, can plant formulas that execute when a user opens the export in a spreadsheet application, potentially exfiltrating cell contents or invoking external commands.
Severity
5.4 (Medium)
CWE
- CWE-1236 - Improper Neutralization of Formula Elements in a CSV File
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/nocodb/nocodb/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/nocodb-befor… | third-party-advisory |
Impacted products
Date Public
2026-10-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "nocodb",
"vendor": "nocodb",
"versions": [
{
"lessThan": "2026.06.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2026.06.1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026.06.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "hunntr"
}
],
"datePublic": "2026-10-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values and column titles beginning with formula characters into CSV exports without neutralization. Low-privileged collaborators, or unauthenticated users submitting a public form, can plant formulas that execute when a user opens the export in a spreadsheet application, potentially exfiltrating cell contents or invoking external commands."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "Improper Neutralization of Formula Elements in a CSV File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:36:33.112Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8wgf-24mr-w88q)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-8wgf-24mr-w88q"
},
{
"name": "VulnCheck Advisory: NocoDB before 2026.06.1 CSV Formula Injection via export.service.ts",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nocodb-before-2026.06.1-csv-formula-injection-via-export-service-ts"
}
],
"title": "NocoDB before 2026.06.1 CSV Formula Injection via export.service.ts",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126289",
"datePublished": "2026-11-13T09:36:33.112Z",
"dateReserved": "2026-11-10T20:15:03.179Z",
"dateUpdated": "2026-11-13T09:36:33.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124591 (GCVE-0-2026-124591)
Vulnerability from cvelistv5 – Published: 2026-11-09 10:30 – Updated: 2026-11-09 22:33
VLAI
EPSS
VEX
Title
Bahleel CsvExporter.php fputcsv csv injection
Summary
A vulnerability was detected in Bahleel 0.1.0/0.1.1. Affected is the function fputcsv of the file app/Exporters/CsvExporter.php. The manipulation results in csv injection. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 22:33 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/433015 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/433015/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124591 | third-party-advisory |
| https://vuldb.com/submit/1040551 | third-party-advisory |
| https://github.com/bahleel/bahleel/issues/1 | issue-tracking |
| https://github.com/bahleel/bahleel/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124591",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T22:33:46.272325Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:33:56.858Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:bahleel:bahleel:*:*:*:*:*:*:*:*"
],
"product": "Bahleel",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "0.1.0"
},
{
"status": "affected",
"version": "0.1.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "summmm (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Bahleel 0.1.0/0.1.1. Affected is the function fputcsv of the file app/Exporters/CsvExporter.php. The manipulation results in csv injection. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "CSV Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T10:30:16.361Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-433015 | Bahleel CsvExporter.php fputcsv csv injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/433015"
},
{
"name": "VDB-433015 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/433015/cti"
},
{
"name": "CVE-2026-124591 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124591"
},
{
"name": "Submit #1040551 | Bahleel Team Bahleel v0.1.1 CSV Formula Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1040551"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/bahleel/bahleel/issues/1"
},
{
"tags": [
"product"
],
"url": "https://github.com/bahleel/bahleel/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T21:49:00.000Z",
"value": "VulDB entry last update"
}
],
"title": "Bahleel CsvExporter.php fputcsv csv injection",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124591",
"datePublished": "2026-11-09T10:30:16.361Z",
"dateReserved": "2026-11-08T20:43:07.074Z",
"dateUpdated": "2026-11-09T22:33:56.858Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124018 (GCVE-0-2026-124018)
Vulnerability from cvelistv5 – Published: 2026-11-12 13:35 – Updated: 2026-11-12 17:17 X_Open Source
VLAI
EPSS
VEX
Title
Gutenverse Form WordPress Plugin < 3.2.2 CSV Formula Injection via Form Submission
Summary
Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or esc_html() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an attacker-controlled URL or command execution on the administrator's workstation.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 16:38 UTC
CWE
- CWE-1236 - Improper Neutralization of Formula Elements in a CSV File
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://wordpress.org/plugins/gutenverse-form/#de… | release-notespatch |
| https://www.vulncheck.com/advisories/gutenverse-f… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Jegstudio | Gutenverse Form – Contact Form Builder, Block Form & Booking Form |
Affected:
0 , < 3.2.2
(semver)
|
Date Public
2026-11-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124018",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T16:38:20.354317Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T17:17:47.526Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gutenverse Form \u2013 Contact Form Builder, Block Form \u0026 Booking Form",
"vendor": "Jegstudio",
"versions": [
{
"lessThan": "3.2.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "buiih"
}
],
"datePublic": "2026-11-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or esc_html() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an attacker-controlled URL or command execution on the administrator\u0027s workstation."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "Improper Neutralization of Formula Elements in a CSV File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T13:35:12.175Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "WordPress Changelog",
"tags": [
"release-notes",
"patch"
],
"url": "https://wordpress.org/plugins/gutenverse-form/#developers"
},
{
"name": "VulnCheck Advisory: Gutenverse Form WordPress Plugin \u003c 3.2.2 CSV Formula Injection via Form Submission",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/gutenverse-form-wordpress-plugin-csv-formula-injection-via-form-submission"
}
],
"tags": [
"x_open-source"
],
"title": "Gutenverse Form WordPress Plugin \u003c 3.2.2 CSV Formula Injection via Form Submission",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-124018",
"datePublished": "2026-11-12T13:35:12.175Z",
"dateReserved": "2026-11-06T18:38:38.544Z",
"dateUpdated": "2026-11-12T17:17:47.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121433 (GCVE-0-2026-121433)
Vulnerability from cvelistv5 – Published: 2026-11-03 14:28 – Updated: 2026-11-03 17:00
VLAI
EPSS
VEX
Title
AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export
Summary
AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/{station_id}/files/bulk so formulas evaluate when other users open exported CSVs in spreadsheets.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 16:59 UTC
CWE
- CWE-1236 - Improper Neutralization of Formula Elements in a CSV File
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/AzuraCast/AzuraCast/security/a… | vendor-advisory |
| https://www.vulncheck.com/advisories/azuracast-be… | third-party-advisory |
Impacted products
Date Public
2026-10-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121433",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T16:59:47.575721Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T17:00:53.992Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-5x35-83gj-w8gw"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AzuraCast",
"vendor": "AzuraCast",
"versions": [
{
"lessThan": "0.24.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.24.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:azuracast:azuracast:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.24.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Xzhong6"
}
],
"datePublic": "2026-10-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/{station_id}/files/bulk so formulas evaluate when other users open exported CSVs in spreadsheets."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "Improper Neutralization of Formula Elements in a CSV File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T14:28:26.431Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-5x35-83gj-w8gw)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-5x35-83gj-w8gw"
},
{
"name": "VulnCheck Advisory: AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/azuracast-before-0.24.0-stored-csv-formula-injection-via-bulk-media-export"
}
],
"title": "AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121433",
"datePublished": "2026-11-03T14:28:26.431Z",
"dateReserved": "2026-11-03T12:30:48.366Z",
"dateUpdated": "2026-11-03T17:00:53.992Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116649 (GCVE-0-2026-116649)
Vulnerability from cvelistv5 – Published: 2026-10-27 17:35 – Updated: 2026-11-04 17:41
VLAI
EPSS
VEX
Title
Tanium addressed an improper output sanitization vulnerability in Enforce.
Summary
Tanium addressed an improper output sanitization vulnerability in Enforce.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 17:41 UTC
CWE
- CWE-1236 - Improper Neutralization of Formula Elements in a CSV File
Assigner
References
1 reference
Impacted products
Date Public
2026-10-27 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116649",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T17:41:34.882839Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T17:41:45.332Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Enforce",
"vendor": "Tanium",
"versions": [
{
"lessThan": "2.9.736",
"status": "affected",
"version": "2.9",
"versionType": "custom"
},
{
"lessThan": "2.10.778",
"status": "affected",
"version": "2.10",
"versionType": "custom"
},
{
"lessThan": "3.0.373",
"status": "affected",
"version": "3.0",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-26T19:15:03.481Z",
"datePublic": "2026-10-27T17:26:21.674Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an improper output sanitization vulnerability in Enforce."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "Improper Neutralization of Formula Elements in a CSV File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:35:06.420Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-072",
"url": "https://security.tanium.com/TAN-2026-072"
}
],
"title": "Tanium addressed an improper output sanitization vulnerability in Enforce."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-116649",
"datePublished": "2026-10-27T17:35:06.420Z",
"dateReserved": "2026-10-26T19:15:03.641Z",
"dateUpdated": "2026-11-04T17:41:45.332Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116648 (GCVE-0-2026-116648)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:17 – Updated: 2026-11-06 19:25
VLAI
EPSS
VEX
Title
Tanium addressed an improper output sanitization vulnerability in Discover.
Summary
Tanium addressed an improper output sanitization vulnerability in Discover.
Severity
4.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:25 UTC
CWE
- CWE-1236 - Improper Neutralization of Formula Elements in a CSV File
Assigner
References
1 reference
Impacted products
Date Public
2026-11-03 22:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116648",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:25:48.391903Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:25:57.879Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Discover",
"vendor": "Tanium",
"versions": [
{
"lessThan": "4.19.137",
"status": "affected",
"version": "4.19.0",
"versionType": "custom"
},
{
"lessThan": "4.15.218",
"status": "affected",
"version": "4.15.0",
"versionType": "custom"
},
{
"lessThan": "4.10.204",
"status": "affected",
"version": "4.10.0",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-26T19:15:03.099Z",
"datePublic": "2026-11-03T22:12:08.447Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an improper output sanitization vulnerability in Discover."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "Improper Neutralization of Formula Elements in a CSV File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:17:23.571Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-084",
"url": "https://security.tanium.com/TAN-2026-084"
}
],
"title": "Tanium addressed an improper output sanitization vulnerability in Discover."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-116648",
"datePublished": "2026-11-03T22:17:23.571Z",
"dateReserved": "2026-10-26T19:15:03.323Z",
"dateUpdated": "2026-11-06T19:25:57.879Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116647 (GCVE-0-2026-116647)
Vulnerability from cvelistv5 – Published: 2026-10-27 17:35 – Updated: 2026-11-04 17:42
VLAI
EPSS
VEX
Title
Tanium addressed an improper output sanitization vulnerability in Comply.
Summary
Tanium addressed an improper output sanitization vulnerability in Comply.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 17:42 UTC
CWE
- CWE-1236 - Improper Neutralization of Formula Elements in a CSV File
Assigner
References
1 reference
Impacted products
Date Public
2026-10-27 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116647",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T17:42:42.245985Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T17:42:52.372Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Comply",
"vendor": "Tanium",
"versions": [
{
"lessThan": "2.32.263",
"status": "affected",
"version": "2.32",
"versionType": "custom"
},
{
"lessThan": "2.35.323",
"status": "affected",
"version": "2.35",
"versionType": "custom"
},
{
"lessThan": "2.37.326",
"status": "affected",
"version": "2.37",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2026-10-26T19:15:02.679Z",
"datePublic": "2026-10-27T17:26:20.848Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an improper output sanitization vulnerability in Comply."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "Improper Neutralization of Formula Elements in a CSV File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:35:06.241Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-069",
"url": "https://security.tanium.com/TAN-2026-069"
}
],
"title": "Tanium addressed an improper output sanitization vulnerability in Comply."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-116647",
"datePublished": "2026-10-27T17:35:06.241Z",
"dateReserved": "2026-10-26T19:15:02.873Z",
"dateUpdated": "2026-11-04T17:42:52.372Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111038 (GCVE-0-2026-111038)
Vulnerability from cvelistv5 – Published: 2026-11-04 09:44 – Updated: 2026-11-09 21:15
VLAI
EPSS
VEX
Title
Multiple vulnerabilities in Coupa’s Total Spend Management Platform
Summary
CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in CSV files generated by the application. An attacker with low privileges can input specially crafted values that begin with characters interpreted as formulas by spreadsheet applications. When a victim downloads and opens the generated file in a compatible client, the content may be interpreted as a formula, potentially leading to unauthorised actions such as the execution of commands via mechanisms such as DDE, access to information, or interaction with system resources under the victim’s context.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 21:14 UTC
CWE
- CWE-1236 - Improper neutralization of formula elements in a CSV file
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Coupa | Coupa Total Spend Management Platform |
Affected:
0 , < 04/11/2026
(custom)
cpe:2.3:a:coupa:coupa_total_spend_management_platform:*:*:*:*:*:*:*:* |
Date Public
2026-11-04 09:37
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111038",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T21:14:51.075782Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T21:15:01.792Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Coupa Total Spend Management Platform",
"vendor": "Coupa",
"versions": [
{
"lessThan": "04/11/2026",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coupa:coupa_total_spend_management_platform:*:*:*:*:*:*:*:*",
"versionEndExcluding": "04_11_2026",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "David Sacrist\u00e1n Manzanares"
}
],
"datePublic": "2026-11-04T09:37:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in CSV files generated by the application. An attacker with low privileges can input specially crafted values that begin with characters interpreted as formulas by spreadsheet applications. When a victim downloads and opens the generated file in a compatible client, the content may be interpreted as a formula, potentially leading to unauthorised actions such as the execution of commands via mechanisms such as DDE, access to information, or interaction with system resources under the victim\u2019s context."
}
],
"value": "CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in CSV files generated by the application. An attacker with low privileges can input specially crafted values that begin with characters interpreted as formulas by spreadsheet applications. When a victim downloads and opens the generated file in a compatible client, the content may be interpreted as a formula, potentially leading to unauthorised actions such as the execution of commands via mechanisms such as DDE, access to information, or interaction with system resources under the victim\u2019s context."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "CWE-1236 Improper neutralization of formula elements in a CSV file",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T09:44:04.821Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No solution has been reported as yet."
}
],
"value": "No solution has been reported as yet."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple vulnerabilities in Coupa\u2019s Total Spend Management Platform",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111038",
"datePublished": "2026-11-04T09:44:04.821Z",
"dateReserved": "2026-10-15T12:29:42.969Z",
"dateUpdated": "2026-11-09T21:15:01.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109396 (GCVE-0-2026-109396)
Vulnerability from cvelistv5 – Published: 2026-10-12 15:16 – Updated: 2026-10-13 15:22
VLAI
EPSS
VEX
Title
Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports
Summary
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +, - or @ that CSVSerializer exports verbatim, executing formulas in the administrator's spreadsheet application.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:21 UTC
CWE
- CWE-1236 - Improper Neutralization of Formula Elements in a CSV File
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/thelia/thelia/security/advisor… | vendor-advisory |
| https://github.com/thelia/thelia/commit/c00a26f06… | patch |
| https://github.com/thelia/thelia/commit/6e4605922… | patch |
| https://github.com/thelia/thelia/blob/3.2.0/core/… | technical-description |
| https://github.com/thelia/thelia/releases/tag/3.1.2 | release-notes |
| https://github.com/thelia/thelia/releases/tag/3.2.1 | release-notes |
| https://www.vulncheck.com/advisories/thelia-befor… | third-party-advisory |
Impacted products
Date Public
2026-10-06 10:17
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109396",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:21:28.032308Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:22:23.047Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/thelia/thelia/security/advisories/GHSA-gcgv-f8rf-w2wc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/thelia/thelia",
"product": "Thelia",
"repo": "https://github.com/thelia/thelia",
"vendor": "Thelia",
"versions": [
{
"lessThan": "3.1.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "3.2.1",
"status": "affected",
"version": "3.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HunterSploit"
}
],
"datePublic": "2026-10-06T10:17:07.000Z",
"descriptions": [
{
"lang": "en",
"value": "Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +, - or @ that CSVSerializer exports verbatim, executing formulas in the administrator\u0027s spreadsheet application."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "Improper Neutralization of Formula Elements in a CSV File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T15:16:41.909Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-gcgv-f8rf-w2wc)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/thelia/thelia/security/advisories/GHSA-gcgv-f8rf-w2wc"
},
{
"tags": [
"patch"
],
"url": "https://github.com/thelia/thelia/commit/c00a26f0631ed9de3c4466176db6e808a25034aa"
},
{
"tags": [
"patch"
],
"url": "https://github.com/thelia/thelia/commit/6e46059225d87565caf4859ec0f764354e82ce95"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/thelia/thelia/blob/3.2.0/core/lib/Thelia/Core/Serializer/Serializer/CSVSerializer.php"
},
{
"name": "Thelia 3.1.2 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/thelia/thelia/releases/tag/3.1.2"
},
{
"name": "Thelia 3.2.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/thelia/thelia/releases/tag/3.2.1"
},
{
"name": "VulnCheck Advisory: Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/thelia-before-3.1.2-and-3.2-x-before-3.2.1-csv-formula-injection-via-exports"
}
],
"title": "Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109396",
"datePublished": "2026-10-12T15:16:41.909Z",
"dateReserved": "2026-10-12T14:40:47.844Z",
"dateUpdated": "2026-10-13T15:22:23.047Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Implementation
When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
Mitigation
Implementation
If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
Mitigation
Architecture and Design
Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.
No CAPEC attack patterns related to this CWE.