SourceCodester Pharmacy Sales and Inventory System up to version 1.0 contains a CSV Injection vulnerability identified as CVE-2026-10248. The flaw is located in the create_supplier function of the /Export_csv/export file, part of the Supplier Creation Interface. By manipulating the Address or Company Name fields, an attacker can inject malicious content into CSV exports. This vulnerability can be exploited remotely without user interaction and has a CVSS 4.0 base score of 5.1, indicating medium severity. No official fix or patch has been published by the vendor as of the current information.

Successful exploitation of this vulnerability could allow an attacker to inject malicious formulas or code into CSV files generated by the system. When these CSV files are opened by users in spreadsheet applications, the injected content could execute, potentially leading to data manipulation or further compromise. However, the impact is limited by the need for the victim to open the crafted CSV file. There is no indication of privilege escalation or direct system compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening CSV files exported from the affected system, especially those containing supplier Address or Company Name data. Implement input validation or sanitization on these fields if possible to reduce injection risk.