Threats tagged 'ghsa-2p5x-4jr6-x5jg'

FacturaScripts versions prior to 2026.2 are vulnerable to CSV formula injection via the CSV export feature. A low-privilege authenticated user can insert malicious formula payloads into text fields such as customer names. When an admin exports data to CSV and opens it in spreadsheet software like Excel or LibreOffice, the embedded formulas execute, potentially running arbitrary commands on the admin's machine. The vulnerability arises because the export function wraps cell values in quotes but does not neutralize leading formula trigger characters, and the input sanitization only removes HTML metacharacters, not formula prefixes.