CVE-2017-15879

High

Published: 24/10/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

CSV Injection (also known as Excel Macro Injection or Formula Injection) exists in KeystoneJS before version 4.0.0-beta.7 via a value that is mishandled in a CSV export.

Risk Assessment

An attacker can inject malicious formulas into CSV files, potentially leading to unauthorized macro execution in applications like Excel, exposing the organization to data loss or other threats.

Recommendation

It is recommended to upgrade KeystoneJS to version 4.0.0-beta.7 or later to mitigate this vulnerability and implement appropriate validation filters for data exported to CSV.

Other vulnerabilities in KeystoneJS

CVE-2017-16570High
KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value. It fails to reject requests that lack an x-csrf-token header.

Original NVD description (English source)

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS