CWE-1236
AllowedImproper Neutralization of Formula Elements in a CSV File
Abstraction: Base · Status: Incomplete
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
419 vulnerabilities reference this CWE, most recent first.
GHSA-WC29-X275-PGCQ
Vulnerability from github – Published: 2022-11-09 12:00 – Updated: 2022-11-09 19:02CSV Injection vulnerability in Activity Log Team Activity Log <= 2.8.3 on WordPress.
{
"affected": [],
"aliases": [
"CVE-2022-27858"
],
"database_specific": {
"cwe_ids": [
"CWE-1236",
"CWE-74"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-08T19:15:00Z",
"severity": "CRITICAL"
},
"details": "CSV Injection vulnerability in Activity Log Team Activity Log \u003c= 2.8.3 on WordPress.",
"id": "GHSA-wc29-x275-pgcq",
"modified": "2022-11-09T19:02:26Z",
"published": "2022-11-09T12:00:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27858"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/aryo-activity-log/wordpress-activity-log-plugin-2-8-3-csv-injection-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/aryo-activity-log/#developers"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WC34-P4FH-WR9Q
Vulnerability from github – Published: 2025-07-31 21:31 – Updated: 2026-01-12 09:30An issue was discovered in Archer Technology RSA Archer 6.11.00204.10014 allowing attackers to execute arbitrary code via crafted system inputs that would be exported into the CSV and be executed after the user opened the file with compatible applications.
{
"affected": [],
"aliases": [
"CVE-2025-50572"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T20:15:43Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Archer Technology RSA Archer 6.11.00204.10014 allowing attackers to execute arbitrary code via crafted system inputs that would be exported into the CSV and be executed after the user opened the file with compatible applications.",
"id": "GHSA-wc34-p4fh-wr9q",
"modified": "2026-01-12T09:30:30Z",
"published": "2025-07-31T21:31:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50572"
},
{
"type": "WEB",
"url": "https://github.com/shorooq-hummdi/Archer-csv-injection-command-exec/blob/main/README.md"
},
{
"type": "WEB",
"url": "https://www.archerirm.community/s/blogs/formula-injection-into-csv-files-vulnerability-in-rsa-archer-6-1-x-and-higher-MCOCQFO3WCQBCCHMKNC74JGSFWQY"
},
{
"type": "WEB",
"url": "http://archer.com"
},
{
"type": "WEB",
"url": "http://rsa.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WHRX-MMGR-GPCF
Vulnerability from github – Published: 2026-08-28 17:46 – Updated: 2026-08-28 17:46Impact
In Snipe-IT v8.6.1 and lower, Actionlog::logaction() stores the request User-Agent header in user_agent. That value is later included in the Activity Report CSV export by ReportsController::postActivityReport() and written with plain fputcsv().
A low-privileged authenticated user can set a formula-like User-Agent, perform a logged action, and have that value stored in the activity log. If an admin or report viewer later exports the Activity Report and opens it in spreadsheet software, the formula may execute.
Example payload:
User-Agent: =HYPERLINK("https://example.com/","click")
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 8.6.1"
},
"package": {
"ecosystem": "Packagist",
"name": "snipe/snipe-it"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.6.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55452"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-28T17:46:16Z",
"nvd_published_at": "2026-07-10T20:16:46Z",
"severity": "MODERATE"
},
"details": "### Impact\nIn Snipe-IT v8.6.1 and lower, `Actionlog::logaction()` stores the request User-Agent header in user_agent. That value is later included in the Activity Report CSV export by `ReportsController::postActivityReport()` and written with plain `fputcsv()`.\n\nA low-privileged authenticated user can set a formula-like User-Agent, perform a logged action, and have that value stored in the activity log. If an admin or report viewer later exports the Activity Report and opens it in spreadsheet software, the formula may execute.\n\nExample payload:\n\n`User-Agent: =HYPERLINK(\"https://example.com/\",\"click\")`",
"id": "GHSA-whrx-mmgr-gpcf",
"modified": "2026-08-28T17:46:16Z",
"published": "2026-08-28T17:46:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-whrx-mmgr-gpcf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55452"
},
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/commit/7b7d2c87fbc965a7933b1bf9e3f2c331b8c8e19c"
},
{
"type": "PACKAGE",
"url": "https://github.com/grokability/snipe-it"
},
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/releases/tag/v8.5.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Snipe-IT has CSV formula injection in Activity Report export"
}
GHSA-WHXV-P57P-V97W
Vulnerability from github – Published: 2022-09-25 00:00 – Updated: 2022-09-28 00:00Authenticated (author+) CSV Injection vulnerability in Export Post Info plugin <= 1.2.0 at WordPress.
{
"affected": [],
"aliases": [
"CVE-2022-38061"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-23T15:15:00Z",
"severity": "MODERATE"
},
"details": "Authenticated (author+) CSV Injection vulnerability in Export Post Info plugin \u003c= 1.2.0 at WordPress.",
"id": "GHSA-whxv-p57p-v97w",
"modified": "2022-09-28T00:00:24Z",
"published": "2022-09-25T00:00:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38061"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/export-post-info/wordpress-export-post-info-plugin-1-2-0-authenticated-csv-injection-vulnerability/_s_id=cve"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/export-post-info/#developers"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WP6X-2JJ2-VXHW
Vulnerability from github – Published: 2022-05-24 19:12 – Updated: 2022-05-24 19:12Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export.
{
"affected": [],
"aliases": [
"CVE-2021-27020"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-30T18:15:00Z",
"severity": "HIGH"
},
"details": "Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export.",
"id": "GHSA-wp6x-2jj2-vxhw",
"modified": "2022-05-24T19:12:28Z",
"published": "2022-05-24T19:12:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27020"
},
{
"type": "WEB",
"url": "https://puppet.com/security/cve/CVE-2021-27020"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WP9X-2QX4-MFCG
Vulnerability from github – Published: 2022-10-25 19:00 – Updated: 2022-10-26 12:00The Post to CSV by BestWebSoft WordPress plugin through 1.4.0 does not properly escape fields when exporting data as CSV, leading to a CSV injection
{
"affected": [],
"aliases": [
"CVE-2022-3393"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-25T17:15:00Z",
"severity": "CRITICAL"
},
"details": "The Post to CSV by BestWebSoft WordPress plugin through 1.4.0 does not properly escape fields when exporting data as CSV, leading to a CSV injection",
"id": "GHSA-wp9x-2qx4-mfcg",
"modified": "2022-10-26T12:00:30Z",
"published": "2022-10-25T19:00:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3393"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/689b4c42-c516-4c57-8ec7-3a6f12a3594e"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WQ79-2F22-34W5
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-05-24 17:34IBM FileNet Content Manager 5.5.4 and 5.5.5 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 188736.
{
"affected": [],
"aliases": [
"CVE-2020-4759"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-09T21:15:00Z",
"severity": "HIGH"
},
"details": "IBM FileNet Content Manager 5.5.4 and 5.5.5 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 188736.",
"id": "GHSA-wq79-2f22-34w5",
"modified": "2022-05-24T17:34:05Z",
"published": "2022-05-24T17:34:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-4759"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/188736"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6336917"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WR7V-H9P2-5FR6
Vulnerability from github – Published: 2023-11-07 21:30 – Updated: 2026-04-28 21:33Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce.This issue affects Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: from n/a through 5.5.2.
{
"affected": [],
"aliases": [
"CVE-2022-45810"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-07T17:15:08Z",
"severity": "CRITICAL"
},
"details": "Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express \u2013 Email Marketing, Newsletters and Automation for WordPress \u0026 WooCommerce.This issue affects Icegram Express \u2013 Email Marketing, Newsletters and Automation for WordPress \u0026 WooCommerce: from n/a through 5.5.2.",
"id": "GHSA-wr7v-h9p2-5fr6",
"modified": "2026-04-28T21:33:02Z",
"published": "2023-11-07T21:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45810"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/email-subscribers/vulnerability/wordpress-icegram-express-email-subscribers-newsletters-and-marketing-automation-plugin-plugin-5-5-2-csv-injection?_s_id=cve"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/email-subscribers/wordpress-icegram-express-email-subscribers-newsletters-and-marketing-automation-plugin-plugin-5-5-2-csv-injection?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WX87-PJ46-74F6
Vulnerability from github – Published: 2022-06-08 00:00 – Updated: 2022-06-15 00:00A vulnerability, which was classified as critical, has been found in SevOne Network Management System up to 5.7.2.22. This issue affects the Device Manager Page. An injection leads to privilege escalation. The attack may be initiated remotely.
{
"affected": [],
"aliases": [
"CVE-2020-36531"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-07T18:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability, which was classified as critical, has been found in SevOne Network Management System up to 5.7.2.22. This issue affects the Device Manager Page. An injection leads to privilege escalation. The attack may be initiated remotely.",
"id": "GHSA-wx87-pj46-74f6",
"modified": "2022-06-15T00:00:23Z",
"published": "2022-06-08T00:00:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36531"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.162263"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Oct/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X232-X9VJ-7XWQ
Vulnerability from github – Published: 2023-08-28 03:30 – Updated: 2024-04-04 07:13IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 244368.
{
"affected": [],
"aliases": [
"CVE-2023-22877"
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-28T01:15:07Z",
"severity": "HIGH"
},
"details": "IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 244368.",
"id": "GHSA-x232-x9vj-7xwq",
"modified": "2024-04-04T07:13:44Z",
"published": "2023-08-28T03:30:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22877"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/244368"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6988623"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
Mitigation
If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
Mitigation
Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.
No CAPEC attack patterns related to this CWE.