https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 19:18:36 +0000 https://cve.radiocsirt.org/vuln/cnvd-2020-38889 cnvd-2020-38889 https://cve.radiocsirt.org/vuln/cnvd-2020-38889 https://cve.radiocsirt.org/vuln/euvd-2026-36536 EUVD-2026-36536 https://cve.radiocsirt.org/vuln/euvd-2026-36536 https://cve.radiocsirt.org/vuln/fkie_cve-2020-5299 <p>In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data that could eventually be exported as a CSV file from the `ImportExportController` could potentially introduce a CSV injection into the data to cause the generated CSV export file to be malicious. This requires attackers to achieve the following before a successful attack can be completed: 1. Have found a vulnerability in the victims spreadsheet software of choice. 2. Control data that would potentially be exported through the `ImportExportController` by a theoretical victim. 3. Convince the victim to export above data as a CSV and run it in vulnerable spreadsheet software while also bypassing any sanity checks by said software. Issue has been patched in Build 466 (v1.0.466).</p> <p>In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data that could eventually be exported as a CSV file from the `ImportExportController` could potentially introduce a CSV injection into the data to cause the generated CSV export file to be malicious. This requires attackers to achieve the following before a successful attack can be completed: 1. Have found a vulnerability in the victims spreadsheet software of choice. 2. Control data that would potentially be exported through the `ImportExportController` by a theoretical victim. 3. Convince the victim to export above data as a CSV and run it in vulnerable spreadsheet software while also bypassing any sanity checks by said software. Issue has been patched in Build 466 (v1.0.466).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-5299 https://cve.radiocsirt.org/vuln/ghsa-4rhm-m2fp-hx7q <p><strong>Affected:</strong> Packagist: october/backend</p> <p>### Impact Any users with the ability to modify any data that could eventually be exported as a CSV file from the `ImportExportController` could potentially introduce a CSV injection into the data to cause the generated CSV export file to be malicious. This requires attackers to achieve the following before a successful attack can be completed:</p> <p>1. Have found a vulnerability in the victim&#39;s spreadsheet software of choice. 2. Control data that would potentially be exported through the `ImportExportController` by a theoretical victim. 3. Convince the victim to export above data as a CSV and run it in vulnerable spreadsheet software while also bypassing any sanity checks by said software.</p> <p>### Patches Issue has been patched in Build 466 (v1.0.466).</p> <p>### Workarounds Apply https://github.com/octobercms/library/commit/c84bf03f506052c848f2fddc05f24be631427a1a &amp; https://github.com/octobercms/october/commit/802d8c8e09a2b342649393edb6d3ceb958851484 to your installation manually if unable to upgrade to Build 466.</p> <p>### References Reported by @chrisvidal initially &amp; [Sivanesh Ashok](https://stazot.com/) later.</p> <p>### For more information If you have any questions or comments about this advisory: * Email us at [hello@octobercms.com](mailto:hello@octobercms.com)</p> <p>### Threat assessment: Given the number of hoops that a potential attacker would have to jump through, this vulnerability really boils down to the possibility of abusing the trust that a user may have in the export functionality of…</p> <p><strong>Affected:</strong> Packagist: october/backend</p> <p>### Impact Any users with the ability to modify any data that could eventually be exported as a CSV file from the `ImportExportController` could potentially introduce a CSV injection into the data to cause the generated CSV export file to be malicious. This requires attackers to achieve the following before a successful attack can be completed:</p> <p>1. Have found a vulnerability in the victim&#39;s spreadsheet software of choice. 2. Control data that would potentially be exported through the `ImportExportController` by a theoretical victim. 3. Convince the victim to export above data as a CSV and run it in vulnerable spreadsheet software while also bypassing any sanity checks by said software.</p> <p>### Patches Issue has been patched in Build 466 (v1.0.466).</p> <p>### Workarounds Apply https://github.com/octobercms/library/commit/c84bf03f506052c848f2fddc05f24be631427a1a &amp; https://github.com/octobercms/october/commit/802d8c8e09a2b342649393edb6d3ceb958851484 to your installation manually if unable to upgrade to Build 466.</p> <p>### References Reported by @chrisvidal initially &amp; [Sivanesh Ashok](https://stazot.com/) later.</p> <p>### For more information If you have any questions or comments about this advisory: * Email us at [hello@octobercms.com](mailto:hello@octobercms.com)</p> <p>### Threat assessment: Given the number of hoops that a potential attacker would have to jump through, this vulnerability really boils down to the possibility of abusing the trust that a user may have in the export functionality of…</p> https://cve.radiocsirt.org/vuln/ghsa-4rhm-m2fp-hx7q https://cve.radiocsirt.org/vuln/gsd-2020-5299 gsd-2020-5299 https://cve.radiocsirt.org/vuln/gsd-2020-5299