Monthly
CSV formula injection in exceljs-hardened before version 5.0.0 allows attackers who can influence exported cell values to embed spreadsheet formulas in generated CSV output by supplying values beginning with =, +, -, or @. When a victim opens the resulting CSV in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, injected formulas execute in the spreadsheet context, enabling data exfiltration or unauthorized actions within that application. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.4 reflects high confidentiality impact and a scope change to the subsequent spreadsheet application system.
CSV injection (CWE-1236) in Brainstorm Force SureForms versions ≤ 2.1.1 enables remote unauthenticated attackers to embed spreadsheet formula directives inside user-controlled form field names, which are written unsanitized into CSV exports generated by administrators. When a site admin exports form submissions and opens the resulting file in a vulnerable spreadsheet application such as Microsoft Excel or LibreOffice Calc, the embedded formulas execute in the context of that administrator's workstation. A public proof-of-concept is available on GitHub; however, EPSS sits at 0.34% (27th percentile) and this CVE is not in the CISA KEV catalog, suggesting limited real-world exploitation to date.
CSV formula injection in Typebot 3.16.1's result-export feature lets remote, unauthenticated chatbot users embed spreadsheet formulas (e.g. =, +, -, @) into form input fields that are written unsanitized into exported CSV files; when an administrator opens the export in Excel or LibreOffice Calc, the injected formula executes in the admin's context. Tracked as CWE-1236 with a vendor CVSS of 9.6 (scope-changed), it is patched in 3.17.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored CSV formula injection in FacturaScripts (all versions through 2026.1) lets an authenticated low-privilege user plant spreadsheet formula payloads in ordinary text fields (customer/supplier/product names, contacts) that execute when an administrator opens a routine list export. Because Core/Lib/Export/CSVExport.php::writeData() wraps values without neutralising leading =,+,-,@,tab, or carriage-return characters, and Tools::noHtml() only strips HTML metacharacters, the payload reaches the CSV verbatim and Excel/LibreOffice run it (including DDE process spawning) in the admin's OS context. A live PoC was verified on 2026-04-30, so publicly available exploit code exists, though there is no active exploitation confirmed (not in CISA KEV).
CSV formula injection in MIA Technology's Pizzy Library (versions 1.0.0.26250 through 1.3.9.26250) allows authenticated attackers to inject malicious formula elements into generated CSV files, leading to code execution when the file is opened in a spreadsheet application. The flaw is rated CVSS 8.8 and was reported by TR-CERT, though no public exploit identified at time of analysis. Impact spans confidentiality, integrity, and availability on the system of any victim who opens the crafted CSV.
Formula/CSV injection in HostBill billing automation builds 2025-11-24 and 2025-12-01 lets a remote unauthenticated attacker plant malicious spreadsheet formulas through a user-facing registration field, which are later exported and detonated when an operator opens the generated CSV, yielding code execution on the operator's workstation and potential privilege escalation. Tracked as CWE-1236 with a 9.8 CVSS and SSVC classifying it as PoC-available, automatable, with total technical impact; publicly available exploit code exists via a third-party GitHub write-up, but it is not on CISA KEV and EPSS is low at 0.10% (28th percentile). The vendor has published a security advisory and release notes covering the affected builds.
HUSTOJ online judge system has a CSV injection vulnerability in all versions that allows code execution through crafted submissions exported to spreadsheets.
Spreadsheet formula injection in OpenClaw's attendance CSV export allows an attacker who controls a participant display name to embed formula payloads (cells beginning with =, +, -, @, tab or carriage return) that execute in the spreadsheet of anyone who opens the exported file in a formula-enabled application such as Excel or LibreOffice Calc, affecting all versions before 2026.8.1. Exploitation is unauthenticated per the supplied vectors (PR:N in both CVSS:4.0 and the assessed CVSS:3.1), but it is heavily gated: the attendance export must be generated, the attacker must control a name included in it, and a victim must open the CSV and permit formula evaluation. Payloads run client-side on the viewer's machine rather than on the OpenClaw host, no public exploit code has been identified at time of analysis, and no impact occurs if exports are never opened in a formula-processing tool.
CSV formula injection in OpenClaw (npm package `openclaw`) prior to 2026.8.1 allows a lower-trust participant who can influence a session label or the first user message to plant a formula-like cell that gets written into the Control UI's Usage/session CSV export; if an operator opens that export in a spreadsheet application with formula evaluation enabled, the cell may execute with the spreadsheet user's permissions. OpenClaw itself never evaluates the formula and the practical impact depends entirely on the downstream spreadsheet's security settings, so successful abuse requires a chain of operator actions (exporting the CSV, opening it in a formula-evaluating spreadsheet, dismissing content warnings). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the independently assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) reflects a low-priority, interaction-heavy issue rather than a direct server-side compromise.
CSV formula injection in WWBN AVideo (through commit c3edcc274) enables authenticated users to embed spreadsheet formula payloads in comments that execute when administrators or video owners open exported CSV files from the myComments.download.php endpoint. The unsanitized comment text containing =, +, -, or @ prefixes is written directly into the CSV output, which spreadsheet applications interpret as executable expressions. Depending on the victim's application and security settings, this can chain to OS command execution via DDE or similar mechanisms, elevating a low-privilege user's impact to the admin's local session. No public exploit has been identified and it is not listed in CISA KEV.
CSV formula injection in exceljs-hardened before version 5.0.0 allows attackers who can influence exported cell values to embed spreadsheet formulas in generated CSV output by supplying values beginning with =, +, -, or @. When a victim opens the resulting CSV in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, injected formulas execute in the spreadsheet context, enabling data exfiltration or unauthorized actions within that application. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.4 reflects high confidentiality impact and a scope change to the subsequent spreadsheet application system.
CSV injection (CWE-1236) in Brainstorm Force SureForms versions ≤ 2.1.1 enables remote unauthenticated attackers to embed spreadsheet formula directives inside user-controlled form field names, which are written unsanitized into CSV exports generated by administrators. When a site admin exports form submissions and opens the resulting file in a vulnerable spreadsheet application such as Microsoft Excel or LibreOffice Calc, the embedded formulas execute in the context of that administrator's workstation. A public proof-of-concept is available on GitHub; however, EPSS sits at 0.34% (27th percentile) and this CVE is not in the CISA KEV catalog, suggesting limited real-world exploitation to date.
CSV formula injection in Typebot 3.16.1's result-export feature lets remote, unauthenticated chatbot users embed spreadsheet formulas (e.g. =, +, -, @) into form input fields that are written unsanitized into exported CSV files; when an administrator opens the export in Excel or LibreOffice Calc, the injected formula executes in the admin's context. Tracked as CWE-1236 with a vendor CVSS of 9.6 (scope-changed), it is patched in 3.17.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored CSV formula injection in FacturaScripts (all versions through 2026.1) lets an authenticated low-privilege user plant spreadsheet formula payloads in ordinary text fields (customer/supplier/product names, contacts) that execute when an administrator opens a routine list export. Because Core/Lib/Export/CSVExport.php::writeData() wraps values without neutralising leading =,+,-,@,tab, or carriage-return characters, and Tools::noHtml() only strips HTML metacharacters, the payload reaches the CSV verbatim and Excel/LibreOffice run it (including DDE process spawning) in the admin's OS context. A live PoC was verified on 2026-04-30, so publicly available exploit code exists, though there is no active exploitation confirmed (not in CISA KEV).
CSV formula injection in MIA Technology's Pizzy Library (versions 1.0.0.26250 through 1.3.9.26250) allows authenticated attackers to inject malicious formula elements into generated CSV files, leading to code execution when the file is opened in a spreadsheet application. The flaw is rated CVSS 8.8 and was reported by TR-CERT, though no public exploit identified at time of analysis. Impact spans confidentiality, integrity, and availability on the system of any victim who opens the crafted CSV.
Formula/CSV injection in HostBill billing automation builds 2025-11-24 and 2025-12-01 lets a remote unauthenticated attacker plant malicious spreadsheet formulas through a user-facing registration field, which are later exported and detonated when an operator opens the generated CSV, yielding code execution on the operator's workstation and potential privilege escalation. Tracked as CWE-1236 with a 9.8 CVSS and SSVC classifying it as PoC-available, automatable, with total technical impact; publicly available exploit code exists via a third-party GitHub write-up, but it is not on CISA KEV and EPSS is low at 0.10% (28th percentile). The vendor has published a security advisory and release notes covering the affected builds.
HUSTOJ online judge system has a CSV injection vulnerability in all versions that allows code execution through crafted submissions exported to spreadsheets.
Spreadsheet formula injection in OpenClaw's attendance CSV export allows an attacker who controls a participant display name to embed formula payloads (cells beginning with =, +, -, @, tab or carriage return) that execute in the spreadsheet of anyone who opens the exported file in a formula-enabled application such as Excel or LibreOffice Calc, affecting all versions before 2026.8.1. Exploitation is unauthenticated per the supplied vectors (PR:N in both CVSS:4.0 and the assessed CVSS:3.1), but it is heavily gated: the attendance export must be generated, the attacker must control a name included in it, and a victim must open the CSV and permit formula evaluation. Payloads run client-side on the viewer's machine rather than on the OpenClaw host, no public exploit code has been identified at time of analysis, and no impact occurs if exports are never opened in a formula-processing tool.
CSV formula injection in OpenClaw (npm package `openclaw`) prior to 2026.8.1 allows a lower-trust participant who can influence a session label or the first user message to plant a formula-like cell that gets written into the Control UI's Usage/session CSV export; if an operator opens that export in a spreadsheet application with formula evaluation enabled, the cell may execute with the spreadsheet user's permissions. OpenClaw itself never evaluates the formula and the practical impact depends entirely on the downstream spreadsheet's security settings, so successful abuse requires a chain of operator actions (exporting the CSV, opening it in a formula-evaluating spreadsheet, dismissing content warnings). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the independently assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) reflects a low-priority, interaction-heavy issue rather than a direct server-side compromise.
CSV formula injection in WWBN AVideo (through commit c3edcc274) enables authenticated users to embed spreadsheet formula payloads in comments that execute when administrators or video owners open exported CSV files from the myComments.download.php endpoint. The unsanitized comment text containing =, +, -, or @ prefixes is written directly into the CSV output, which spreadsheet applications interpret as executable expressions. Depending on the victim's application and security settings, this can chain to OS command execution via DDE or similar mechanisms, elevating a low-privilege user's impact to the admin's local session. No public exploit has been identified and it is not listed in CISA KEV.