CSV export functionality in Brainstorm Force SureForms version, <= 2.1.1, fails to neutralize spreadsheet formula characters in user-controlled form… (CVE-2026-19501)

The CSV export feature in Brainstorm Force SureForms versions <= 2.1.1 does not properly sanitize or neutralize spreadsheet formula characters in user-controlled form field names. As a result, an attacker can craft form inputs containing malicious spreadsheet formulas. When an administrator exports the form data to CSV and opens the file in a spreadsheet application that processes formulas, these formulas execute, potentially leading to unauthorized actions or data compromise. This vulnerability is tracked as CVE-2026-19501 and is associated with CWE-1236.

Successful exploitation can lead to remote code execution within the context of the spreadsheet application on the administrator's workstation, resulting in full compromise of confidentiality, integrity, and availability of data handled through the CSV export. The CVSS score of 8.8 reflects a high severity due to network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid opening CSV exports from untrusted or user-controlled sources in spreadsheet applications that automatically execute formulas. Consider using spreadsheet applications or settings that disable automatic formula execution when opening CSV files.