Falhas do tipo CWE-1236

204 resultados

Falta de neutralização de fórmulas em arquivos CSV

Quando um arquivo CSV é gerado com dados não sanitizados, fórmulas de planilhas (Excel, LibreOffice) podem ser injetadas. Ao abrir o arquivo, a aplicação executa a fórmula automaticamente, permitindo execução arbitrária de código ou acesso a dados sensíveis do usuário.

Exemplo

Um sistema exporta um relatório CSV com dados de clientes. Um atacante injeta no banco de dados o valor '=cmd|'/c calc'!A1', que fica no CSV. Quando um analista abre em Excel, a calculadora é executada no computador dele.

Como mitigar

Prefixe células suspeitas com aspas ou espaço (='' + formula) antes de exportar, ou use formatos seguros como ODS/XLSX com validação de fórmulas. Oriente usuários a desabilitar execução automática de macros em imports.

CVE-2026-89246MEDIUMWWBN AVideo CSV Formula Injection via myComments.download.phpEPSS 0.2%CVE-2026-109396LOWThelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via ExportsEPSS 0.2%CVE-2025-11279MEDIUMAxosoft Scrum and Bug Tracking Add Work Item csv injectionEPSS 0.2%CVE-2026-27644MEDIUMtraccar allows CSV formula injection via exported position dataEPSS 0.2%CVE-2023-37219HIGH Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV FileEPSS 0.2%CVE-2025-61873LOWBest Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used.EPSS 0.2%CVE-2026-42267MEDIUMKimai: Formula Injection via tag names in XLSX exportEPSS 0.2%CVE-2026-55154MEDIUMEspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in exportEPSS 0.2%CVE-2026-9852MEDIUMA CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrEPSS 0.2%CVE-2026-116648MEDIUMTanium addressed an improper output sanitization vulnerability in Discover.EPSS 0.2%CVE-2026-116649HIGHTanium addressed an improper output sanitization vulnerability in Enforce.EPSS 0.2%CVE-2025-52612HIGHHCL iControl was affected by Export CSV - CSV Injection vulnerability.EPSS 0.2%CVE-2026-121433MEDIUMAzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media ExportEPSS 0.2%CVE-2026-108579LOWOpenPanel through 2.3.0 CSV Formula Injection via Cohort Member ExportEPSS 0.2%CVE-2026-56652MEDIUMFormula Injection in dool projectEPSS 0.2%CVE-2026-93581MEDIUMInsufficient Neutralization of Formula Elements in CSV ExportsEPSS 0.2%CVE-2026-100564MEDIUMOpenClaw before 2026.8.1 CSV Formula Injection via Attendance ExportEPSS 0.2%CVE-2026-100563MEDIUMOpenClaw before 2026.8.1 CSV Formula Injection via Session LabelsEPSS 0.2%CVE-2026-46672MEDIUMActual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` HelperEPSS 0.2%CVE-2026-67187MEDIUMNinja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List FieldsEPSS 0.2%