https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 05:09:31 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-269866 EUVD-2026-269866 https://cve.radiocsirt.org/vuln/euvd-2026-269866 https://cve.radiocsirt.org/vuln/fkie_cve-2023-51763 <p>csv_builder.rb in ActiveAdmin (aka Active Admin) before 3.2.0 allows CSV injection.</p> <p>csv_builder.rb in ActiveAdmin (aka Active Admin) before 3.2.0 allows CSV injection.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-51763 https://cve.radiocsirt.org/vuln/ghsa-xhvv-3jww-c487 <p><strong>Affected:</strong> RubyGems: activeadmin</p> <p>### Impact</p> <p>In ActiveAdmin versions prior to 3.2.0, maliciously crafted spreadsheet formulas could be uploaded as part of admin data that, when exported to a CSV file and the imported to a spreadsheet program like libreoffice, could lead to remote code execution and private data exfiltration.</p> <p>The attacker would need privileges to upload data to the same ActiveAdmin application as the victim, and would need the victim to possibly ignore security warnings from their spreadsheet program.</p> <p>### Patches</p> <p>Versions 3.2.0 and above fixed the problem by escaping any data starting with `=` and other characters used by spreadsheet programs.</p> <p>### Workarounds</p> <p>Only turn on formula evaluation in spreadsheet programs when importing CSV after explicitly reviewing the file.</p> <p>### References</p> <p>https://owasp.org/www-community/attacks/CSV_Injection https://github.com/activeadmin/activeadmin/pull/8167</p> <p><strong>Affected:</strong> RubyGems: activeadmin</p> <p>### Impact</p> <p>In ActiveAdmin versions prior to 3.2.0, maliciously crafted spreadsheet formulas could be uploaded as part of admin data that, when exported to a CSV file and the imported to a spreadsheet program like libreoffice, could lead to remote code execution and private data exfiltration.</p> <p>The attacker would need privileges to upload data to the same ActiveAdmin application as the victim, and would need the victim to possibly ignore security warnings from their spreadsheet program.</p> <p>### Patches</p> <p>Versions 3.2.0 and above fixed the problem by escaping any data starting with `=` and other characters used by spreadsheet programs.</p> <p>### Workarounds</p> <p>Only turn on formula evaluation in spreadsheet programs when importing CSV after explicitly reviewing the file.</p> <p>### References</p> <p>https://owasp.org/www-community/attacks/CSV_Injection https://github.com/activeadmin/activeadmin/pull/8167</p> https://cve.radiocsirt.org/vuln/ghsa-xhvv-3jww-c487 https://cve.radiocsirt.org/vuln/gsd-2023-51763 gsd-2023-51763 https://cve.radiocsirt.org/vuln/gsd-2023-51763