CWE-1236— Improper Neutralization of Formula Elements in a CSV File

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.— MITRE CWE catalog

336 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-1236page 6 of 7

CVE-2026-86745MEDIUMCVSS 6.5EG 6.5
2026-09-09
Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the code was never included in a tagged release), SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch re…
CVE-2026-86742MEDIUMCVSS 6.5EG 6.5
2026-09-09
Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand (stripping commas and joining rows manually) and, unli…
CVE-2026-27644MEDIUMCVSS 6.5EG 6.5
2026-05-05
Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without proper escaping. An at…
CVE-2026-24447MEDIUMCVSS 6.5EG 6.5
2026-02-04
If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user's en…
CVE-2025-60852MEDIUMCVSS 6.5EG 6.5
2025-10-23
A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600. Applications built with affected versions of the framework did not properly sanitize user-controlled input before including it in CSV export…
CVE-2025-54752MEDIUMCVSS 6.5EG 6.5
2025-07-31
Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user's environment, the embedded code may be …
CVE-2024-28764MEDIUMCVSS 6.5EG 6.5
2024-05-01
IBM WebSphere Automation 1.7.0 could allow an attacker with privileged access to the network to conduct a CSV injection. An attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM …
CVE-2024-28111MEDIUMCVSS 6.5EG 6.5
2024-03-06
Canarytokens helps track activity and actions on a network. Canarytokens.org supports exporting the history of a Canarytoken's incidents in CSV format. The generation of these CSV files is vulnerable to a CSV Injection vulnerability. This …
CVE-2023-47022MEDIUMCVSS 6.5EG 6.5
2024-02-06
Insecure Direct Object Reference in NCR Terminal Handler v.1.5.1 allows an unprivileged user to edit the audit logs for any user and can lead to CSV injection.
CVE-2021-41270MEDIUMCVSS 6.5EG 6.5
2021-11-24
Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Symfony versions 4.1.0 before 4.4.35 and versions 5.0.0 before 5.3…
CVE-2021-1475MEDIUMCVSS 6.5EG 6.5
2021-04-08
Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and link injection attacks on an affected device. For more info…
CVE-2021-1474MEDIUMCVSS 6.5EG 6.5
2021-04-08
Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and link injection attacks on an affected device. For more info…
CVE-2019-16959MEDIUMCVSS 6.5EG 6.5
2020-12-21
SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket.
CVE-2019-13181MEDIUMCVSS 6.5EG 6.5
2019-12-16
A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7.
CVE-2019-6187MEDIUMCVSS 6.5EG 6.5
2019-11-20
A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that coul…
CVE-2026-76797MEDIUMCVSS 6.3EG 6.3
2026-08-28
The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster…
CVE-2025-12249MEDIUMCVSS 6.3EG 6.3
2025-10-27
A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. The impacted element is an unknown function of the component Edit Ticket Page. Performing manipulation of the argument Title results in csv injection. It is possi…
CVE-2022-37786MEDIUMCVSS 6.3EG 6.3
2023-01-01
An issue was discovered in WeCube Platform 3.2.2. There are multiple CSV injection issues: the [Home / Admin / Resources] page, the [Home / Admin / System Params] page, and the [Home / Design / Basekey Configuration] page.
CVE-2020-10780MEDIUMCVSS 6.3EG 6.3
2020-08-11
Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possi…
CVE-2018-12244MEDIUMCVSS 6.3EG 6.3
2019-04-25
SEP (Mac client) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a CSV/DDE injection (also known as formula injection) vulnerability, which is a type of issue whereby an application or website allows untrust…
CVE-2022-38061MEDIUMCVSS 6.2EG 6.2
2022-09-23
Authenticated (author+) CSV Injection vulnerability in Export Post Info plugin <= 1.2.0 at WordPress.
CVE-2026-93581MEDIUMCVSS 6.1EG 6.1
2026-10-12
User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, m…
CVE-2026-64955MEDIUMCVSS 6.1EG 6.1
2026-08-12
When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places suc…
CVE-2026-54243MEDIUMCVSS 6.1EG 6.1
2026-06-26
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, form submission values in src/Forms/Exporters/CsvExporter.php were not neutralized for spreadsheet formula characters when exported to CSV.…
CVE-2025-11498MEDIUMCVSS 6.1EG 6.1
2025-10-14
An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 enabling a remote attacker to inject formula data into a generated CSV file…
CVE-2022-38845MEDIUMCVSS 6.1EG 6.1
2022-09-16
Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious JavaScript to authenticated user. Any authenticated user importin…
CVE-2020-9466MEDIUMCVSS 6.1EG 6.1
2020-02-28
The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection.
CVE-2023-45597MEDIUMCVSS 5.9EG 5.9
2024-03-05
A CWE-1236 “Improper Neutralization of Formula Elements in a CSV File” vulnerability in the “file_configuration” functionality of the web application (concerning the function “export_file”) allows a remote authenticated attacke…
CVE-2021-38424MEDIUMCVSS 5.9EG 5.9
2021-11-03
The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data. Those formulas may then be executed when it is opened with a spreadsheet application.
CVE-2024-3214MEDIUMCVSS 5.8EG 5.8
2024-04-09
The Relevanssi – A Better Search plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 4.22.1. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, whi…
CVE-2022-44738MEDIUMCVSS 5.8EG 5.8
2023-11-07
Improper Neutralization of Formula Elements in a CSV File vulnerability in Patrick Robrecht Posts and Users Stats.This issue affects Posts and Users Stats: from n/a through 1.1.3.
CVE-2022-39217MEDIUMCVSS 5.8EG 5.8
2022-09-17
some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output…
CVE-2026-42267MEDIUMCVSS 5.7EG 5.7
2026-05-08
Kimai is an open-source time tracking application. From version 2.27.0 to before version 2.54.0, any ROLE_USER can create a tag with a formula string as its name (e.g. =SUM(54+51)) via POST /api/tags and assign it to a timesheet. When an a…
CVE-2021-23654MEDIUMCVSS 5.6EG 5.6
2021-11-26
This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can…
CVE-2025-11279MEDIUMCVSS 5.5EG 5.5
2025-10-05
A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. This issue affects some unknown processing of the component Add Work Item Page. The manipulation of the argument Title results in csv injection. The attack can be…
CVE-2018-19855MEDIUMCVSS 5.5EG 5.5
2019-08-08
UiPath Orchestrator before 2018.3.4 allows CSV Injection, related to the Audit export, Robot log export, and Transaction log export features.
CVE-2026-121433MEDIUMCVSS 5.4EG 5.4
2026-11-03
AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or cust…
CVE-2026-55154MEDIUMCVSS 5.4EG 5.4
2026-10-15
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Ex…
CVE-2026-100564MEDIUMCVSS 5.4EG 5.4
2026-09-26
OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the…
CVE-2026-100563MEDIUMCVSS 5.4EG 5.4
2026-09-26
OpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, …
CVE-2026-89246MEDIUMCVSS 5.4EG 5.4
2026-09-11
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated u…
CVE-2026-86257MEDIUMCVSS 5.4EG 5.4
2026-09-06
wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or exec…
CVE-2025-52386MEDIUMCVSS 5.4EG 5.4
2025-08-13
CycloneDX Sunshine v0.9 is vulnerable to CSV Formula Injection via a crafted JSON file
CVE-2024-27785MEDIUMCVSS 5.4EG 5.4
2024-07-09
An improper neutralization of formula elements in a CSV File [CWE-1236] vulnerability in Fortinet FortiAIOps 2.0.0 may allow a remote authenticated attacker to execute arbitrary commands on a client's workstation via poisoned CSV reports.
CVE-2023-43071MEDIUMCVSS 5.4EG 5.4
2023-10-05
Dell SmartFabric Storage Software v1.4 (and earlier) contains possible vulnerabilities for HTML injection or CVS formula injection which might escalate to cross-site scripting attacks in HTML pages in the GUI. A remote authenticated attac…
CVE-2023-29918MEDIUMCVSS 5.4EG 5.4
2023-05-02
RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.
CVE-2026-102799MEDIUMCVSS 5.3EG 5.3
2026-10-28
Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16
CVE-2026-79971MEDIUMCVSS 5.3EG 5.3
2026-09-09
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Sanitization of Custom Special Characters vulnerability. An unauthenticated attacker with remote access cou…
CVE-2023-31296MEDIUMCVSS 5.3EG 5.3
2023-12-29
CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows attackers to obtain sensitive information via the User Name field.
CVE-2020-28861MEDIUMCVSS 5.3EG 5.3
2020-12-14
OpenAsset Digital Asset Management (DAM) 12.0.19 and earlier failed to implement access controls on /Stream/ProjectsCSV endpoint, allowing unauthenticated attackers to gain access to potentially sensitive project information stored by the …

Map vulnerabilities like CWE-1236 to your infrastructure

EchelonGraph correlates every CVE — across CWE-1236 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →