Headline
CVE-2022-28481: Older versions of CSV-Safe gem doesn't filter out special characters which could trigger CSV Injection. (< 3.0.0) · Issue #7 · zvory/csv-safe
CSV-Safe gem < 3.0.0 doesn’t filter out special characters which could trigger CSV Injection.
Older versions of CSV-Safe gem doesn’t filter out special characters which could trigger CSV Injection. (< 3.0.0)
Vulnerability Type
CSV Injection
Product
csv-safe
Affected Product Code Base
CSV-safe - <3.0.0 are effected
Affected Component
Sanitization of CSV Injection vectors.
Attack Type
Remote
Attack Vector
%0A-3+3+cmd|’ /C calc’!D2 could be used to bypass CSV injection sanitizations in older versions.
Discoverers
Danish Tariq
Fixed by
Gabriel Rios - #8
References
https://github.com/zvory/csv-safe
#8
https://hackerone.com/reports/223999
WeblateOrg/weblate@d9e136f
https://bugzilla.mozilla.org/show_bug.cgi?id=1259881