Weaknesses of type CWE-1236

204 results

Neutralização inadequada de fórmulas em arquivos CSV

Ocorre quando um arquivo CSV exportado contém fórmulas (como =SUM(), @SUM() ou similar) que são interpretadas automaticamente por aplicações como Excel ou LibreOffice. Um atacante injeta fórmulas maliciosas nos dados, que executam comandos ou acessam recursos quando o arquivo é aberto, contornando a percepção do usuário de que está apenas lendo dados.

Example

Uma aplicação web exporta dados de usuários para CSV. Um atacante insere o nome '=cmd|' /c calc'!A1' em seu perfil. Quando um admin abre o CSV no Excel, a fórmula executa a calculadora ou outro comando sem avisar.

How to mitigate

Prefixe dados suspeitos com aspas simples (') ou espaço antes de exportar, ou converta as células para texto puro explicitamente. Alternativamente, use formatos como JSON ou XML e oriente os usuários a abrir CSVs com modo de segurança aumentado ou importadores que não interpretam fórmulas.

CVE-2023-45597MEDIUMA CWE-1236 “Improper Neutralization of Formula Elements in a CSV File” vulnerability in the “file_configuration” functionality of the web apEPSS 0.4%CVE-2024-25007HIGHEricsson Network Manager - Improper Neutralization of Formula Elements VulnerabilityEPSS 0.4%CVE-2023-25348HIGHChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new peEPSS 0.4%CVE-2024-27785MEDIUMAn improper neutralization of formula elements in a CSV File [CWE-1236] vulnerability in Fortinet FortiAIOps 2.0.0 may allow a remote authenEPSS 0.4%CVE-2026-14846MEDIUMIncorrect neutralisation in the PrestaShop firmwareEPSS 0.4%CVE-2026-55452MEDIUMSnipe-IT: CSV formula injection in Activity Report exportEPSS 0.4%CVE-2021-23286MEDIUMSecurity issues in Eaton Intelligent Power Manager InfrastructureEPSS 0.4%CVE-2024-9102MEDIUMphpLDAPadmin: Improper Neutralization of Formula ElementsEPSS 0.4%CVE-2024-45084HIGHIBM Cognos Controller CSV injectionEPSS 0.4%CVE-2026-86742MEDIUMSnipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance ReportEPSS 0.4%CVE-2026-78209HIGHexceljs through 4.4.0 CSV Formula Injection via Unescaped Cell ValuesEPSS 0.4%CVE-2025-60852MEDIUMA CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600. Applications built with affected versionsEPSS 0.4%CVE-2023-51298MEDIUMPHPJabbers Event Booking Calendar v4.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulEPSS 0.4%CVE-2023-2629MEDIUMImproper Neutralization of Formula Elements in a CSV File in pimcore/customer-data-frameworkEPSS 0.4%CVE-2025-62417HIGHbagisto - CSV Formula Injection in Create New ProductEPSS 0.4%CVE-2023-43071MEDIUM Dell SmartFabric Storage Software v1.4 (and earlier) contains possible vulnerabilities for HTML injection or CVS formula injection which miEPSS 0.4%CVE-2025-14229MEDIUMSourceCodester Inventory Management System SVC Report Export csv injectionEPSS 0.4%CVE-2023-46400MEDIUMKWHotel 0.47 is vulnerable to CSV Formula Injection in the add guest function.EPSS 0.4%CVE-2026-47693MEDIUMPoweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applicationsEPSS 0.4%CVE-2026-39424MEDIUMMaxKB has CSV Injection in its Application Chat Export FunctionalityEPSS 0.4%