目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-1236 类漏洞列表 153

CWE-1236 类弱点 153 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1236 属于 CSV 注入漏洞，指程序将用户输入写入 CSV 文件时未对特殊字符进行适当转义。攻击者利用此缺陷，在数据中嵌入以等号、加号或制表符开头的恶意公式，当受害者使用电子表格软件打开文件时，这些公式会被自动执行，可能导致数据泄露、远程代码执行或系统配置篡改。开发者应通过转义特殊字符、限制输入内容或采用非公式格式存储数据来防御此类攻击。

MITRE CWE 官方描述
CWE：CWE-1236 CSV 文件中公式元素的不当中和 英文：产品将用户提供的信息保存到逗号分隔值（Comma-Separated Value, CSV）文件中，但未对特殊元素进行中和，或中和不当，导致当文件被电子表格产品打开时，这些元素可能被解释为命令。
常见影响 (1)
Confidentiality Read Application Data, Execute Unauthorized Code or Commands
Attackers can populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software. Note that current versions of Excel warn users of untrusted content.
缓解措施 (3)
Implementation When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
Effectiveness: Moderate
Implementation If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
Effectiveness: Moderate
Architecture and Design Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.
Effectiveness: Limited
代码示例 (1)
Hyperlinks or other commands can be executed when a cell begins with the formula identifier, '='
=HYPERLINK(link_location, [friendly_name])
Attack · Other
HYPERLINK(link_location, [friendly_name])
Good · Other
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-89246 AVideo CSV公式注入漏洞 — AVideo 5.4 Medium 2026-09-11
CVE-2026-86745 Snipe-IT 8.7.0前 CSV公式注入漏洞 — snipe-it 6.5 Medium 2026-09-09
CVE-2026-86742 Snipe-IT 8.7.0 之前 CSV公式注入漏洞 — snipe-it 6.5 Medium 2026-09-09
CVE-2026-79971 Dell SCG 5.0 脚本注入漏洞 — Secure Connect Gateway 5.0 - Application 5.3 Medium 2026-09-09
CVE-2026-86257 wger Project wger 输入验证错误漏洞 — wger 5.4 Medium 2026-09-06
CVE-2026-9852 Hitachi SYS600 输入验证错误漏洞 — MicroSCADA SYS600 4.6 Medium 2026-09-03
CVE-2026-76797 MongoDB BI Connector Transition Readiness Report 输入验证错误漏洞 — BI Connector Transition Readiness Report 6.3 Medium 2026-08-28
CVE-2026-56652 Scott Baker Dool 输入验证错误漏洞 — dool 4.6 Medium 2026-08-27
CVE-2026-78209 exceljs 输入验证错误漏洞 — exceljs 8.2 High 2026-08-24
CVE-2026-64955 Rapid7 Velociraptor 输入验证错误漏洞 — Velociraptor 6.1 Medium 2026-08-12
CVE-2026-47705 Baptiste Arnaud Typebot 输入验证错误漏洞 — typebot.io 9.6 Critical 2026-08-11
CVE-2026-18738 shlinkio Shlink 输入验证错误漏洞 — Shlink 4.7 Medium 2026-08-03
CVE-2026-65875 basercms 输入验证错误漏洞 — BaserCMS 7.1 High 2026-08-03
CVE-2026-54243 Statamic cms 输入验证错误漏洞 — cms 6.1 Medium 2026-07-17
CVE-2026-14846 PrestaShop The firmware 输入验证错误漏洞 — The firmware - - 2026-07-13
CVE-2026-55452 Grokability Snipe-IT 输入验证错误漏洞 — snipe-it - - 2026-07-10
CVE-2026-50179 Actual 输入验证错误漏洞 — actual 4.2 Medium 2026-07-07
CVE-2026-46672 Actual 输入验证错误漏洞 — actual 4.6 Medium 2026-07-07
CVE-2026-47693 poweradmin 输入验证错误漏洞 — poweradmin 6.9 Medium 2026-06-23
CVE-2026-5242 MIA Technology Inc Pizzy Library 输入验证错误漏洞 — Pizzy Library 8.8 High 2026-06-15
CVE-2025-52612 HCL iControl 安全漏洞 — iControl 7.1 High 2026-06-04
CVE-2026-10248 SourceCodester Pharmacy Sales and Inventory System 安全漏洞 — Pharmacy Sales and Inventory System 4.7 Medium 2026-06-01
CVE-2026-9673 json-2-csv 安全漏洞 — json-2-csv 6.8 Medium 2026-05-28
CVE-2026-41073 Request Tracker 安全漏洞 — rt 4.6 Medium 2026-05-22
CVE-2026-35157 Dell ECS和Dell ObjectScale 安全漏洞 — ECS 5.8 Medium 2026-05-11
CVE-2026-42267 kimai 安全漏洞 — kimai 6.5AI Medium AI 2026-05-08
CVE-2026-27644 Traccar 安全漏洞 — traccar 6.5 Medium 2026-05-05
CVE-2023-54348 Rajodiya ERPGo SaaS 安全漏洞 — ERPGo SaaS 8.8 High 2026-05-05
CVE-2026-39424 MaxKB 安全漏洞 — MaxKB 7.8 - 2026-04-14
CVE-2026-24447 Movable Type 安全漏洞 — Movable Type (Software Edition) 8.6AI High AI 2026-02-04

CWE-1236 是常见的弱点类别，本平台收录该类弱点关联的 153 条 CVE 漏洞。