Base weakness
Incomplete
CWE-1236: Improper Neutralization of Formula Elements in a CSV File
Also known as: CSV Injection, Formula Injection, Excel Macro Injection
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Last updated
167
Recorded CVEs
With this primary weakness
0
KEVs
In the CISA KEV catalog
Not rated
Likelihood of exploit
Per MITRE
Base
Abstraction
MITRE classification
Overview
CWE-1236 (Improper Neutralization of Formula Elements in a CSV File) is a base-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.