CWEweakness

CWE-1236 Improper Neutralization of Formula Elements in a CSV File

Official page ↗
Alternate terms
CSV Injection, Formula Injection, Excel Macro Injection
Abstraction
Base
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

Common consequences

• Confidentiality: Read Application Data, Execute Unauthorized Code or Commands — Attackers can populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software. Note that current versions of Excel warn users of untrusted content.

Potential mitigations

• [Implementation] When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at). • [Implementation] If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula. • [Architecture and Design] Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.

Detection methods

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Observed examples

• CVE-2019-12134: Low privileged user can trigger CSV injection through a contact form field value • CVE-2019-4521: Cloud management product allows arbitrary command execution via CSV injection • CVE-2019-17661: CSV injection in content management system via formula code in a first or last name

Related

Observed example · CVE (3)

  • CVE-2019-4521 Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection. vulnerability
  • CVE-2019-17661 A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control… vulnerability
  • CVE-2019-12134 CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in Workday through 32 via a value (provided by… vulnerability

Child of · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

Referenced by CVE · weakness (323)

  • CVE-2026-102799 Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16 vulnerability
  • CVE-2026-67187 Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated… vulnerability
  • CVE-2026-116647 Tanium addressed an improper output sanitization vulnerability in Comply. vulnerability
  • CVE-2026-116649 Tanium addressed an improper output sanitization vulnerability in Enforce. vulnerability
  • CVE-2026-86020 Part-DB is an open source inventory management system for electronic components. vulnerability
  • CVE-2026-55154 EspoCRM is an open source customer relationship management application. vulnerability
  • CVE-2026-109396 Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject… vulnerability
  • CVE-2026-93581 User-controlled values are not sufficiently neutralized when included in CSV exports. vulnerability
  • CVE-2026-108579 OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas… vulnerability
  • CVE-2026-100563 OpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as… vulnerability
  • CVE-2026-100564 OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV… vulnerability
  • CVE-2026-89246 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the… vulnerability
  • CVE-2026-79971 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper… vulnerability
  • CVE-2026-86742 Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. vulnerability
  • CVE-2026-86745 Snipe-IT is an IT asset management application. vulnerability
  • CVE-2026-86257 wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject… vulnerability
  • CVE-2026-9852 A CSV injection vulnerability exists in SYS600. vulnerability
  • CVE-2026-76797 The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading… vulnerability
  • CVE-2026-56652 Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell… vulnerability
  • CVE-2026-78209 exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. vulnerability
  • CVE-2026-19501 CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in… vulnerability
  • CVE-2026-64955 When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary… vulnerability
  • CVE-2026-47705 TypeBot is a chatbot builder tool. vulnerability
  • CVE-2026-18738 Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant… vulnerability
  • CVE-2026-65875 BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. vulnerability
  • CVE-2026-54243 Statamic is a Laravel and Git powered content management system (CMS). vulnerability
  • CVE-2026-14846 In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate… vulnerability
  • CVE-2026-55452 Snipe-IT is an IT asset/license management system. vulnerability
  • CVE-2026-46672 Actual is a local-first personal finance app. vulnerability
  • CVE-2026-50179 Actual is a local-first personal finance tool. vulnerability
Show all 323 ›