GitHub Advisoryadvisory · npm

GHSA-xgwh-cgv9-783v Ghost allows CSV Injection during member CSV export

HIGH Published 2024-05-22 Modified 2024-05-22 Official page ↗

Aliases: CVE-2024-34448
Ecosystem: npm
Packages: @tryghost/members-csv
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-74
Reviewed: 2024-05-22

Affected packages

• npm @tryghost/members-csv: < 5.82.0 → fixed in 5.82.0

Description

Ghost before 5.82.0 allows CSV Injection during a member CSV export.

Related

Alias · CVE (1)

CVE-2024-34448 Ghost before 5.82.0 allows CSV Injection during a member CSV export. vulnerability

Weakness · CWE (1)

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References