Monthly
CSV formula injection in Velociraptor's export pipeline allows attacker-controlled endpoint artifacts to execute as formulas when a forensic analyst opens the exported CSV in Microsoft Excel. Affected export paths include the GUI, offline collector, and data export features - any of which may produce unsanitized CSV output when collected data contains leading formula-trigger characters (=, +, -, @, tab). No public exploit code has been identified and no CISA KEV listing exists; however, the CVSS scope-change metric (S:C) and high confidentiality rating (C:H) correctly reflect that successful exploitation results in formula execution within the analyst's own workstation environment rather than the Velociraptor server itself.
CSV formula injection in Typebot 3.16.1's result-export feature lets remote, unauthenticated chatbot users embed spreadsheet formulas (e.g. =, +, -, @) into form input fields that are written unsanitized into exported CSV files; when an administrator opens the export in Excel or LibreOffice Calc, the injected formula executes in the admin's context. Tracked as CWE-1236 with a vendor CVSS of 9.6 (scope-changed), it is patched in 3.17.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
CSV formula injection in Shlink 5.0.0-5.1.5 enables unauthenticated remote attackers to embed DDE or WEBSERVICE spreadsheet formulas into visit export data by supplying formula-triggering values in User-Agent, Referer, or request path headers targeting any short URL. The payload lies dormant in Shlink's visit log until an administrator exports the data as CSV and opens it in a spreadsheet application (Excel, LibreOffice Calc) with formula evaluation enabled, at which point the formula executes in the context of the administrator's machine. A public proof-of-concept repository exists; no CISA KEV listing is present, and no public exploit exploitation in the wild has been confirmed at time of analysis.
CSV formula injection in BaserCMS enables a remote unauthenticated attacker to embed malicious spreadsheet formulas into user-controlled fields within the CMS. When a privileged user exports affected data as a CSV and opens it in spreadsheet software such as Microsoft Excel or LibreOffice Calc, the injected formula executes in the context of that application on the victim's workstation. The CVSS Scope:Changed (S:C) rating reflects that impact escapes the web application boundary entirely, affecting the victim's local system. No active exploitation (KEV) has been confirmed and no public exploit code has been identified at time of analysis.
Stored CSV formula injection in FacturaScripts (all versions through 2026.1) lets an authenticated low-privilege user plant spreadsheet formula payloads in ordinary text fields (customer/supplier/product names, contacts) that execute when an administrator opens a routine list export. Because Core/Lib/Export/CSVExport.php::writeData() wraps values without neutralising leading =,+,-,@,tab, or carriage-return characters, and Tools::noHtml() only strips HTML metacharacters, the payload reaches the CSV verbatim and Excel/LibreOffice run it (including DDE process spawning) in the admin's OS context. A live PoC was verified on 2026-04-30, so publicly available exploit code exists, though there is no active exploitation confirmed (not in CISA KEV).
CSV formula injection in the PrestaShop module 'The Firmware' version 8.2.1 enables an authenticated attacker to inject malicious spreadsheet expressions via the unsanitized 'Alias' parameter in the address update function. When a victim subsequently exports account data using the 'Get my data in CSV' feature and opens the file in a spreadsheet application, the injected formula executes in that application's context, potentially exfiltrating the victim's personal data or executing commands on their workstation. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 4.5 reflects the high-privilege and user-interaction prerequisites that constrain exploitability.
CSV formula injection in Snipe-IT prior to version 8.5.0 enables a low-privileged authenticated user to store a malicious spreadsheet formula via the HTTP User-Agent header, which is then written unescaped into exported Activity Report CSV files. When an administrator or report viewer opens the exported file in spreadsheet software such as Microsoft Excel or LibreOffice Calc, the embedded formula executes within their local application environment, potentially enabling data exfiltration or arbitrary command execution on the viewer's workstation. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 8.5.0.
CSV formula injection in Statamic CMS allows an unauthenticated front-end visitor to plant spreadsheet formula payloads via public form submissions that execute when a Control Panel editor exports and opens those submissions in a spreadsheet application. Affected versions span the entire v5 branch below 5.73.24 and v6 branch from 6.0.0 below 6.20.1; vendor-released patches exist for both. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the attack structure is well-understood and requires no specialized tooling given the unauthenticated submission vector.
CSV formula injection in Actual Budget's transaction export functions allows an attacker who controls imported transaction data to embed spreadsheet formulas in Payee, Notes, Account, and Category fields, which survive verbatim into exported CSV files. Affected versions of @actual-app/web prior to 26.6.0 pass these fields to csv-stringify at export-to-csv.ts:56 and :131 without any formula-prefix neutralization, meaning strings beginning with =, +, -, @, tab, or carriage return are written raw to disk. When victims or downstream recipients (accountants, tax preparers) open the exported file in Excel, LibreOffice Calc, or Google Sheets, the =HYPERLINK variant silently exfiltrates adjacent transaction data on click with no security prompt, while =WEBSERVICE and =IMPORTXML auto-fire in some configurations; a fully working PoC is documented in GHSA-xqjm-27pc-rvwm and no KEV listing exists at time of analysis.
CSV formula injection in @actual-app/cli versions prior to 26.6.0 allows an attacker who can write user-controlled strings into an Actual Budget database to execute arbitrary spreadsheet formulas when the victim exports data using the --format csv flag and opens the resulting file in Excel, LibreOffice Calc, or Google Sheets. The vulnerable `escapeCsv` helper in `packages/cli/src/output.ts` neutralizes only RFC 4180 delimiters and quotes but does not strip formula-trigger prefixes (=, +, -, @, tab, CR), meaning payloads in payee names, account names, categories, notes, or tags survive into the CSV output unchanged. A publicly available proof-of-concept is included in the GHSA-7gh7-258j-4mpq advisory; no CISA KEV listing exists at time of analysis.
CSV formula injection in Velociraptor's export pipeline allows attacker-controlled endpoint artifacts to execute as formulas when a forensic analyst opens the exported CSV in Microsoft Excel. Affected export paths include the GUI, offline collector, and data export features - any of which may produce unsanitized CSV output when collected data contains leading formula-trigger characters (=, +, -, @, tab). No public exploit code has been identified and no CISA KEV listing exists; however, the CVSS scope-change metric (S:C) and high confidentiality rating (C:H) correctly reflect that successful exploitation results in formula execution within the analyst's own workstation environment rather than the Velociraptor server itself.
CSV formula injection in Typebot 3.16.1's result-export feature lets remote, unauthenticated chatbot users embed spreadsheet formulas (e.g. =, +, -, @) into form input fields that are written unsanitized into exported CSV files; when an administrator opens the export in Excel or LibreOffice Calc, the injected formula executes in the admin's context. Tracked as CWE-1236 with a vendor CVSS of 9.6 (scope-changed), it is patched in 3.17.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
CSV formula injection in Shlink 5.0.0-5.1.5 enables unauthenticated remote attackers to embed DDE or WEBSERVICE spreadsheet formulas into visit export data by supplying formula-triggering values in User-Agent, Referer, or request path headers targeting any short URL. The payload lies dormant in Shlink's visit log until an administrator exports the data as CSV and opens it in a spreadsheet application (Excel, LibreOffice Calc) with formula evaluation enabled, at which point the formula executes in the context of the administrator's machine. A public proof-of-concept repository exists; no CISA KEV listing is present, and no public exploit exploitation in the wild has been confirmed at time of analysis.
CSV formula injection in BaserCMS enables a remote unauthenticated attacker to embed malicious spreadsheet formulas into user-controlled fields within the CMS. When a privileged user exports affected data as a CSV and opens it in spreadsheet software such as Microsoft Excel or LibreOffice Calc, the injected formula executes in the context of that application on the victim's workstation. The CVSS Scope:Changed (S:C) rating reflects that impact escapes the web application boundary entirely, affecting the victim's local system. No active exploitation (KEV) has been confirmed and no public exploit code has been identified at time of analysis.
Stored CSV formula injection in FacturaScripts (all versions through 2026.1) lets an authenticated low-privilege user plant spreadsheet formula payloads in ordinary text fields (customer/supplier/product names, contacts) that execute when an administrator opens a routine list export. Because Core/Lib/Export/CSVExport.php::writeData() wraps values without neutralising leading =,+,-,@,tab, or carriage-return characters, and Tools::noHtml() only strips HTML metacharacters, the payload reaches the CSV verbatim and Excel/LibreOffice run it (including DDE process spawning) in the admin's OS context. A live PoC was verified on 2026-04-30, so publicly available exploit code exists, though there is no active exploitation confirmed (not in CISA KEV).
CSV formula injection in the PrestaShop module 'The Firmware' version 8.2.1 enables an authenticated attacker to inject malicious spreadsheet expressions via the unsanitized 'Alias' parameter in the address update function. When a victim subsequently exports account data using the 'Get my data in CSV' feature and opens the file in a spreadsheet application, the injected formula executes in that application's context, potentially exfiltrating the victim's personal data or executing commands on their workstation. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 4.5 reflects the high-privilege and user-interaction prerequisites that constrain exploitability.
CSV formula injection in Snipe-IT prior to version 8.5.0 enables a low-privileged authenticated user to store a malicious spreadsheet formula via the HTTP User-Agent header, which is then written unescaped into exported Activity Report CSV files. When an administrator or report viewer opens the exported file in spreadsheet software such as Microsoft Excel or LibreOffice Calc, the embedded formula executes within their local application environment, potentially enabling data exfiltration or arbitrary command execution on the viewer's workstation. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 8.5.0.
CSV formula injection in Statamic CMS allows an unauthenticated front-end visitor to plant spreadsheet formula payloads via public form submissions that execute when a Control Panel editor exports and opens those submissions in a spreadsheet application. Affected versions span the entire v5 branch below 5.73.24 and v6 branch from 6.0.0 below 6.20.1; vendor-released patches exist for both. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the attack structure is well-understood and requires no specialized tooling given the unauthenticated submission vector.
CSV formula injection in Actual Budget's transaction export functions allows an attacker who controls imported transaction data to embed spreadsheet formulas in Payee, Notes, Account, and Category fields, which survive verbatim into exported CSV files. Affected versions of @actual-app/web prior to 26.6.0 pass these fields to csv-stringify at export-to-csv.ts:56 and :131 without any formula-prefix neutralization, meaning strings beginning with =, +, -, @, tab, or carriage return are written raw to disk. When victims or downstream recipients (accountants, tax preparers) open the exported file in Excel, LibreOffice Calc, or Google Sheets, the =HYPERLINK variant silently exfiltrates adjacent transaction data on click with no security prompt, while =WEBSERVICE and =IMPORTXML auto-fire in some configurations; a fully working PoC is documented in GHSA-xqjm-27pc-rvwm and no KEV listing exists at time of analysis.
CSV formula injection in @actual-app/cli versions prior to 26.6.0 allows an attacker who can write user-controlled strings into an Actual Budget database to execute arbitrary spreadsheet formulas when the victim exports data using the --format csv flag and opens the resulting file in Excel, LibreOffice Calc, or Google Sheets. The vulnerable `escapeCsv` helper in `packages/cli/src/output.ts` neutralizes only RFC 4180 delimiters and quotes but does not strip formula-trigger prefixes (=, +, -, @, tab, CR), meaning payloads in payee names, account names, categories, notes, or tags survive into the CSV output unchanged. A publicly available proof-of-concept is included in the GHSA-7gh7-258j-4mpq advisory; no CISA KEV listing exists at time of analysis.