CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in CSV files generated by the application. An attacker with low privileges can input specially crafted values that begin with characters interpreted as formulas by spreadsheet applications. When a victim downloads and opens the generated file in a compatible client, the content may be interpreted as a formula, potentially leading to unauthorised actions such as the execution of commands via mechanisms such as DDE, access to information, or interaction with system resources under the victim’s context.
Part-DB-server versions prior to 2.13.2 contain a spreadsheet formula injection vulnerability in the part import/export workflow. Authenticated users with import permissions can craft CSV files with formula-prefixed values that are stored in part fields. When these parts are exported as XLSX files, the formulas are written without neutralization, resulting in executable spreadsheet formulas. Opening the exported spreadsheet may trigger formula evaluation in spreadsheet software. This vulnerability is fixed in version 2.13.2.
CVE-2026-93581 is a vulnerability in OTRS software where user-controlled input is not properly neutralized in CSV exports. This allows attackers to inject spreadsheet formula characters into CSV files, which may be interpreted as formulas when opened in spreadsheet applications. Exploitation requires the victim to open the CSV file and potentially confirm security warnings. The vulnerability affects multiple OTRS versions prior to 2026.7.X and does not involve code execution on the server side.
Dell Secure Connect Gateway (SCG) 5.0 Application versions prior to 5.36.00.00 and Appliance versions prior to 5.36.00.16 contain a vulnerability involving improper sanitization of special characters in CSV files. This flaw could allow an unauthenticated remote attacker to inject scripts via crafted CSV content. The vulnerability is identified as CWE-1236 and has a medium severity rating with a CVSS score of 5.3. No official patch or remediation guidance is currently provided by the vendor.
A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log.
CVE-2026-76797 is a medium severity vulnerability in the MongoDB BI Connector Transition Readiness Report tool. The tool writes database and collection names into CSV reports without neutralizing leading characters that spreadsheet applications interpret as formulas. A user with write privileges can create namespace names that cause spreadsheet applications to evaluate these as formulas when the report is opened, potentially leading to unintended disclosure or execution of external content. Exploitation requires generating a report for the affected namespace and opening it in a spreadsheet application.
Dool versions up to 1.3.8 have a CSV injection vulnerability due to improper sanitization of cell content starting with special formula characters (=, +, -, @). A local attacker can exploit this by creating a process with a crafted name that injects malicious formulas into exported CSV files, which execute when opened in spreadsheet applications. The issue was fixed by pull request #117.
When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution.
Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports.
It is not clear if the vulnerability is actually in Microsoft Excel treating a CSV data file as executable content, or if Velociraptor should be sanitizing the data to prevent Excel from executing it. However, since this is such a common use case for Velociraptor we decided to highlight it in an advisory.
TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or escape user-supplied input when generating CSV files. An attacker can inject spreadsheet formulas into input fields, which are later executed when an administrator opens the exported CSV in spreadsheet software such as Microsoft Excel or LibreOffice Calc. Version 3.17.0 patches the issue.
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, form submission values in src/Forms/Exporters/CsvExporter.php were not neutralized for spreadsheet formula characters when exported to CSV. A submission containing a value beginning with a formula trigger character, such as =, +, -, or @, could be interpreted as a live formula when a Control Panel user opens the export in a spreadsheet application. Form submissions can come from unauthenticated front-end visitors, so the malicious value can be supplied by an anonymous user and is later triggered by an editor opening the export. This issue is fixed in versions 5.73.24 and 6.20.1.
In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ parameter in the ‘Update your address’ function. This flaw allows an attacker to inject malicious expressions that are executed when the information is exported using the ‘Get my data in CSV’ tool. Successful exploitation of this vulnerability could facilitate unauthorised access to the victim’s personal data.
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActivityReport() writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged authenticated user to store a formula-like User-Agent that may execute when a report viewer opens the exported CSV in spreadsheet software. This issue is fixed in version 8.5.0.
Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user-controlled Payee, Notes, Account, and Category strings to csv-stringify with no cast callback and no formula-prefix neutralization. Strings that begin with equals sign, plus, minus, at sign, tab, or carriage return survive verbatim into the exported CSV, and when a recipient opens the file in Excel, LibreOffice Calc, or Google Sheets, the strings are interpreted as formulas, enabling transaction data exfiltration and attacker-chosen spreadsheet display values. This issue is fixed in version 26.6.0.
Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in packages/cli/src/output.ts used whenever the global --format csv option is passed, whose escapeCsv helper only handles RFC 4180 delimiter, quote, and newline escaping and does not neutralize standard CSV formula-injection prefixes. Any CLI command that streams an object array containing user-controlled strings, including transactions list, accounts list, payees list, categories list, tags list, category-groups list, rules list, schedules list, and query, can emit cells that auto-evaluate when the resulting CSV is opened in Excel, LibreOffice Calc, or Google Sheets, enabling data exfiltration and arbitrary formula execution. This issue is fixed in version 26.6.0.
CVE-2026-5242 is a high-severity vulnerability in MIA Technology Inc.'s Pizzy Library affecting versions from 1.0.0.26250 up to but not including 1.3.9.26250. The issue involves improper neutralization of formula elements in CSV files, which can lead to code injection. This vulnerability can result in high impact on confidentiality, integrity, and availability if exploited.
HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters. .
Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications.
RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by avoiding opening exported RT spreadsheet files directly in spreadsheet applications when the data may contain untrusted user input.
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula elements in a CSV File vulnerability in the UI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.