Weaknesses of type CWE-1236

204 results

Neutralização inadequada de fórmulas em arquivos CSV

Ocorre quando um arquivo CSV exportado contém fórmulas (como =SUM(), @SUM() ou similar) que são interpretadas automaticamente por aplicações como Excel ou LibreOffice. Um atacante injeta fórmulas maliciosas nos dados, que executam comandos ou acessam recursos quando o arquivo é aberto, contornando a percepção do usuário de que está apenas lendo dados.

Example

Uma aplicação web exporta dados de usuários para CSV. Um atacante insere o nome '=cmd|' /c calc'!A1' em seu perfil. Quando um admin abre o CSV no Excel, a fórmula executa a calculadora ou outro comando sem avisar.

How to mitigate

Prefixe dados suspeitos com aspas simples (') ou espaço antes de exportar, ou converta as células para texto puro explicitamente. Alternativamente, use formatos como JSON ou XML e oriente os usuários a abrir CSVs com modo de segurança aumentado ou importadores que não interpretam fórmulas.

CVE-2025-58855HIGHWordPress AP HoneyPot WordPress Plugin Plugin <= 1.4 - Cross Site Request Forgery (CSRF) VulnerabilityEPSS 0.2%CVE-2026-109396LOWThelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via ExportsEPSS 0.2%CVE-2025-11279MEDIUMAxosoft Scrum and Bug Tracking Add Work Item csv injectionEPSS 0.2%CVE-2026-27644MEDIUMtraccar allows CSV formula injection via exported position dataEPSS 0.2%CVE-2023-37219HIGH Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV FileEPSS 0.2%CVE-2025-61873LOWBest Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used.EPSS 0.2%CVE-2026-42267MEDIUMKimai: Formula Injection via tag names in XLSX exportEPSS 0.2%CVE-2026-55154MEDIUMEspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in exportEPSS 0.2%CVE-2026-9852MEDIUMA CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrEPSS 0.2%CVE-2026-116648MEDIUMTanium addressed an improper output sanitization vulnerability in Discover.EPSS 0.2%CVE-2026-116649HIGHTanium addressed an improper output sanitization vulnerability in Enforce.EPSS 0.2%CVE-2025-52612HIGHHCL iControl was affected by Export CSV - CSV Injection vulnerability.EPSS 0.2%CVE-2026-121433MEDIUMAzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media ExportEPSS 0.2%CVE-2026-108579LOWOpenPanel through 2.3.0 CSV Formula Injection via Cohort Member ExportEPSS 0.2%CVE-2026-56652MEDIUMFormula Injection in dool projectEPSS 0.2%CVE-2026-93581MEDIUMInsufficient Neutralization of Formula Elements in CSV ExportsEPSS 0.2%CVE-2026-100563MEDIUMOpenClaw before 2026.8.1 CSV Formula Injection via Session LabelsEPSS 0.2%CVE-2026-100564MEDIUMOpenClaw before 2026.8.1 CSV Formula Injection via Attendance ExportEPSS 0.2%CVE-2026-46672MEDIUMActual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` HelperEPSS 0.2%CVE-2026-67187MEDIUMNinja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List FieldsEPSS 0.2%