CVE-2025-60852

A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600

Medium · published October 23, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
34.0
In the wild
Unconfirmed
What it is

A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600. Applications built with affected versions of the framework did not properly sanitize user-controlled input before including it in CSV exports. This issue could lead to code execution on the system where the exported CSV file is opened.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00408 · 34.0th percentile
Published
2025-10-23T00:00Z
EPSS history
Timeline
  • 23 OCT 00:00Z
    A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600
    cvelistv5