GHSA-663j-rjcr-789f

CSV injection in shuup

Source: GitHub Advisory Database (reviewed) High CVE-2021-25962

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	shuup	>= 0.4.2, < 2.11.0	2.11.0

Details

As written in the advisory (Markdown source, shown as plain text).

“Shuup” application in versions 0.4.2 to 2.10.8 is affected by the “Formula Injection” vulnerability. A customer can inject payloads in the name input field in the billing address while buying a product. When a store administrator accesses the reports page to export the data as an Excel file and opens it, the payload gets executed.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-25962 advisory
https://github.com/shuup/shuup/commit/0a2db392e8518410c282412561461cd8797eea51 web
https://github.com/pypa/advisory-database/tree/main/vulns/shuup/PYSEC-2021-355.yaml web
https://github.com/shuup/shuup package
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25962 web