Fallos del tipo CWE-1236

204 resultados

Falta de neutralização de fórmulas em arquivos CSV

Quando um arquivo CSV contém fórmulas (como =cmd|'/c calc'!A1 ou =1+1), aplicativos que abrem o arquivo automaticamente as interpretam e executam, permitindo injeção de código. O risco é alto porque o usuário apenas abre um arquivo aparentemente inofensivo e o aplicativo (Excel, Calc, etc.) executa comandos maliciosos sem aviso adequado.

Ejemplo

Um relatório exportado em CSV com dados de usuários contém um campo começando com '=' que, quando aberto no Excel, executa uma macro ou comando do sistema. Um atacante injeta a fórmula no banco de dados ou upload de arquivo, e qualquer pessoa que baixe e abra o CSV sofre o ataque.

Cómo mitigar

Prefixe campos suspeitos com um caractere neutro (como aspas simples ou espaço) antes de gerar o CSV, ou configure o aplicativo para não interpretar fórmulas automaticamente. Na aplicação, valide e escape qualquer conteúdo que inicie com caracteres de fórmula (=, +, -, @, tabulação).

CVE-2025-58855HIGHWordPress AP HoneyPot WordPress Plugin Plugin <= 1.4 - Cross Site Request Forgery (CSRF) VulnerabilityEPSS 0.2%CVE-2026-109396LOWThelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via ExportsEPSS 0.2%CVE-2025-11279MEDIUMAxosoft Scrum and Bug Tracking Add Work Item csv injectionEPSS 0.2%CVE-2026-27644MEDIUMtraccar allows CSV formula injection via exported position dataEPSS 0.2%CVE-2023-37219HIGH Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV FileEPSS 0.2%CVE-2025-61873LOWBest Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used.EPSS 0.2%CVE-2026-42267MEDIUMKimai: Formula Injection via tag names in XLSX exportEPSS 0.2%CVE-2026-55154MEDIUMEspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in exportEPSS 0.2%CVE-2026-9852MEDIUMA CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrEPSS 0.2%CVE-2026-116648MEDIUMTanium addressed an improper output sanitization vulnerability in Discover.EPSS 0.2%CVE-2026-116649HIGHTanium addressed an improper output sanitization vulnerability in Enforce.EPSS 0.2%CVE-2025-52612HIGHHCL iControl was affected by Export CSV - CSV Injection vulnerability.EPSS 0.2%CVE-2026-121433MEDIUMAzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media ExportEPSS 0.2%CVE-2026-108579LOWOpenPanel through 2.3.0 CSV Formula Injection via Cohort Member ExportEPSS 0.2%CVE-2026-56652MEDIUMFormula Injection in dool projectEPSS 0.2%CVE-2026-93581MEDIUMInsufficient Neutralization of Formula Elements in CSV ExportsEPSS 0.2%CVE-2026-100564MEDIUMOpenClaw before 2026.8.1 CSV Formula Injection via Attendance ExportEPSS 0.2%CVE-2026-100563MEDIUMOpenClaw before 2026.8.1 CSV Formula Injection via Session LabelsEPSS 0.2%CVE-2026-46672MEDIUMActual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` HelperEPSS 0.2%CVE-2026-67187MEDIUMNinja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List FieldsEPSS 0.2%