Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS03cnE0LXFjcHctNzRncc4AArtK

Formula Injection in Exported Data

Impact

Datasets exported to file (e.g. CSV / XLS) are not sufficiently sanitized, to neutralize potential formula injection

Patches

• The issue is addressed in the upcoming 0.8.0 release
• This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release

Workarounds

Users exporting untrusted data should open the files in safe mode (e.g. in Microsoft Excel).

References

• https://huntr.dev/bounties/e57c36e7-fa39-435f-944a-3a52ee066f73/
• https://owasp.org/www-community/attacks/CSV_Injection

For more information

If you have any questions or comments about this advisory:

• Open an issue in github
• Email us at [email protected]

Permalink: https://github.com/advisories/GHSA-7rq4-qcpw-74gq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03cnE0LXFjcHctNzRncc4AArtK
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: over 1 year ago

Identifiers: GHSA-7rq4-qcpw-74gq
References:

• https://github.com/inventree/InvenTree/security/advisories/GHSA-7rq4-qcpw-74gq
• https://github.com/advisories/GHSA-7rq4-qcpw-74gq

Repository: https://github.com/inventree/InvenTree
Blast Radius: 0.0

Affected Packages