Critical · published January 28, 2026
⚠️ A crafty CSV formula injection is hiding in Tendenci 12.3.1's contact form! If an attacker submits a clever payload, they can execute arbitrary commands when the CSV is opened. 🔥 Think of it like a restaurant where customers can write their own orders, including sneaky requests for the kitchen to whip up surprises. If no one's checking those orders, the chef might end up making something they never intended! An attacker could exploit this vulnerability to execute harmful commands on a user's system simply by injecting a formula into the contact form. This could lead to serious security breaches, especially if the spreadsheet opens with macros enabled, giving the attacker full control!
Think of it like a restaurant where customers can write their own orders, including sneaky requests for the kitchen to whip up surprises. If no one's checking those orders, the chef might end up making something they never intended! This vulnerability allows malicious users to inject formulas into the contact form message field, which can then execute commands when the resulting CSV file is opened in spreadsheet applications—potentially leading to arbitrary command execution.
An attacker could exploit this vulnerability to execute harmful commands on a user's system simply by injecting a formula into the contact form. This could lead to serious security breaches, especially if the spreadsheet opens with macros enabled, giving the attacker full control! To mitigate this, ensure you update Tendenci to version 12.3.2 or later. Additionally, validate and sanitize all user input in the contact form to prevent injection attacks, and educate users to never enable macros in untrusted spreadsheets. You've got this! By taking these steps, you'll help keep your data safe and secure. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| tendenci/tendenci | all versions | — |