What is the CVSS score of CVE-2026-5242?

CVE-2026-5242 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Pizzy Library are affected by CVE-2026-5242?

MIA Technology's Pizzy Library (versions 1.0.0.26250 through 1.3.9.26250) contains a CSV formula injection vulnerability (CVSS 8.8) that enables code execution when users open crafted CSV files in…. A patch is available.

How to fix or mitigate CVE-2026-5242?

Within 24 hours: Identify all systems and applications using Pizzy Library versions 1.0.0.26250-1.3.9.26250; publish security advisory cautioning users against opening CSV files from untrusted sources. Within 7 days: Evaluate disabling CSV export functionality or implementing formula-character sanitization controls; audit CSV file creation and sharing practices. Within 30 days: Monitor MIA Technology advisories for patch availability; develop upgrade or migration plan to eliminate vulnerable versions; document remediation completion.

Pizzy Library CVE-2026-5242

EUVD-2026-36719 HIGH

Improper Neutralization of Formula Elements in a CSV File (CWE-1236)

2026-06-15 TR-CERT

GHSA-qv7c-w6cp-c775

Code Injection Pizzy Library Mia Technology Inc

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (TR-CERT) PRIMARY

HIGH

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Authenticated input injection (PR:L) over the network; exploitation requires victim to open the CSV (UI:R) and impact lands on the spreadsheet host, not Pizzy (S:C), with full CIA impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (TR-CERT).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 15, 2026 - 16:01 EUVD

Analysis Generated

Jun 15, 2026 - 14:31 vuln.today

DescriptionNVD

Improper neutralization of formula elements in a CSV file vulnerability in MIA Technology Inc. Pizzy Library allows Code Injection.

This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250.

AnalysisAI

CSV formula injection in MIA Technology's Pizzy Library (versions 1.0.0.26250 through 1.3.9.26250) allows authenticated attackers to inject malicious formula elements into generated CSV files, leading to code execution when the file is opened in a spreadsheet application. The flaw is rated CVSS 8.8 and was reported by TR-CERT, though no public exploit identified at time of analysis. Impact spans confidentiality, integrity, and availability on the system of any victim who opens the crafted CSV.

Technical ContextAI

Pizzy Library is a .NET reporting/export component from MIA Technology Inc. used to generate documents including CSV outputs. The root cause is CWE-1236 (Improper Neutralization of Formula Elements in a CSV File), where untrusted user input is written into CSV cells without escaping leading characters such as '=', '+', '-', '@', or tab/CR. When the resulting file is opened in Microsoft Excel, LibreOffice Calc, or Google Sheets, those characters are interpreted as formula prefixes, enabling DDE calls, HYPERLINK exfiltration, or WEBSERVICE/IMPORTDATA requests that can pivot to arbitrary command execution via the spreadsheet engine.

RemediationAI

Upgrade Pizzy Library to version 1.3.9.26250 or later, the first fixed release per the affected-range metadata; consult the TR-CERT bulletin at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0383 for vendor coordination details. If patching is delayed, sanitize all user-controlled input flowing into CSV exports by prefixing cells that begin with '=', '+', '-', '@', tab, or carriage return with a leading single quote or wrapping the value in quotes, recognizing that this may visibly alter legitimate values that start with those characters. As compensating controls, restrict who can submit data that ends up in exports, deliver CSVs as XLSX with formulas disabled, and instruct downstream users to open exports in a viewer that prompts before evaluating formulas; note that user-training mitigations degrade quickly and should not replace the code fix.