Threats tagged 'ghsa-3gg5-c8gj-frxr'

Apache Syncope contains an improper encoding or escaping of output vulnerability (CVE-2026-73195) that allows authenticated users to store spreadsheet formula payloads in their own plain attributes. When these users are included in a CSV export, opening the CSV file in a spreadsheet application may execute the formula. This affects versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Upgrading to versions 4.0.8 or 4.1.3 mitigates the issue.