Servers and applications

GHSA-c76w-4wg2-hpgf

Stored spreadsheet formula injection in CSV and XLSX exports

Severity: Medium 4.6
Published: 12 Nov 2026
Last changed: 12 Nov 2026
Added to UpHeron: 12 Nov 2026
Fixed in: 15.119.0, 16.32.0
Weakness: CSV injection (CWE-1236)
Attack: Over the network · Needs a user account · Needs someone to click or open something
Attacker can: Read some data · Change some data
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Sources: Project advisories (GitHub)

Description

Stored spreadsheet formula injection in CSV and XLSX exports is possible.

There are no workarounds. Updating to the latest versions of Frappe Framework should resolve this.

Software	Affected versions
Frappe FrameworkServers and applications · `github:frappe/frappe`	Every version before 16.32.0 Every version before 15.119.0

GitHub Advisory Database https://github.com/advisories/GHSA-c76w-4wg2-hpgf
github.com https://github.com/frappe/frappe/security/advisories/GHSA-c76w-4wg2-hpgf