GitHub Advisoryadvisory · PyPI

GHSA-4q3w-jgfx-4792 Tendenci is Vulnerable to CSV Formula Injection through its Contact Form Message Field

MEDIUM Published 2026-01-28 Modified 2026-06-09 Official page ↗
Aliases
CVE-2020-36962
Ecosystem
PyPI
Packages
tendenci
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1236
Reviewed
2026-06-09

Affected packages

• PyPI tendenci: < 12.3.2 → fixed in 12.3.2

Description

Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads like '=10+20+cmd|' /C calc'!A0' in the message field to trigger arbitrary command execution when the CSV is opened in spreadsheet applications.

Related

Alias · CVE (1)

  • CVE-2020-36962 Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious… vulnerability

Weakness · CWE (1)

  • CWE-1236 Improper Neutralization of Formula Elements in a CSV File weakness

References