| Impact | Details |
|---|---|
|
Read Application Data; Execute Unauthorized Code or Commands |
Scope: Confidentiality
Likelihood: Low
Current versions of Excel warn users of untrusted content.
|
| Phase(s) | Mitigation |
|---|---|
|
Implementation |
When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
Effectiveness: Moderate Note:
Unfortunately, there is no perfect solution, since different spreadsheet products act differently.
|
|
Implementation |
If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
Effectiveness: Moderate Note:
It is not clear how effective this mitigation is with other spreadsheet software.
|
|
Architecture and Design |
Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.
Effectiveness: Limited Note:
This mitigation has limited effectiveness because it often depends on end users opening spreadsheet software safely.
|
| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf | Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') |
| Nature | Type | ID | Name |
|---|---|---|---|
| MemberOf | Category Category - a CWE entry that contains a set of other entries that share a common characteristic. | 137 | Data Neutralization Issues |
| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf | Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') |
| Phase | Note |
|---|---|
| Implementation | The weakness is in the implementation of a software's CSV export feature, in particular how it formats formula entries as the output gets flattened into a text file. |
Class: Not Language-Specific (Undetermined Prevalence)
Class: Not OS-Specific (Undetermined Prevalence)
Class: Not Architecture-Specific (Undetermined Prevalence)
Other (Undetermined Prevalence)
Example 1
Hyperlinks or other commands can be executed when a cell begins with the formula identifier, '='
=HYPERLINK(link_location, [friendly_name])
Stripping the leading equals sign, or simply not executing formulas from untrusted sources, impedes malicious activity.
HYPERLINK(link_location, [friendly_name])
Note: this is a curated list of examples for users to understand the variety of ways in which this weakness can be introduced. It is not a complete list of all CVEs that are related to this CWE entry.
| Reference | Description |
|---|---|
|
Low privileged user can trigger CSV injection through a contact form field value
|
|
|
Cloud management product allows arbitrary command execution via CSV injection
|
|
|
CSV injection in content management system via formula code in a first or last name
|
| Nature | Type | ID | Name |
|---|---|---|---|
| MemberOf | CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. | 1409 | Comprehensive Categorization: Injection |
Rationale
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.Comments
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.| Submissions | ||
|---|---|---|
| Submission Date | Submitter | Organization |
|
2019年11月21日
(CWE 4.0, 2020年02月24日) |
CWE Content Team | MITRE |
| Modifications | ||
| Modification Date | Modifier | Organization |
|
2025年09月09日
(CWE 4.18, 2025年09月09日) |
CWE Content Team | MITRE |
| updated References | ||
|
2025年04月03日
(CWE 4.17, 2025年04月03日) |
CWE Content Team | MITRE |
| updated Demonstrative_Examples | ||
| 2023年06月29日 | CWE Content Team | MITRE |
| updated Mapping_Notes | ||
| 2023年04月27日 | CWE Content Team | MITRE |
| updated References, Relationships | ||
| 2023年01月31日 | CWE Content Team | MITRE |
| updated Description | ||
| 2021年03月15日 | CWE Content Team | MITRE |
| updated Description, Potential_Mitigations | ||
| 2020年08月20日 | CWE Content Team | MITRE |
| updated Relationships | ||
Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2025, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.