Improper Neutralization of Formula Elements in a CSV File in html-2-csv

🗓️ 30 Nov 2021 22:22:16Reported by GitHub Advisory DatabaseType

Improper Neutralization of Formula Elements in a CSV File in html-2-csv. This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a malicious link or execute commands via CSV files

Reporter	Title	Published	Views	Family All 12
CNNVD	Html2Csv 代码注入漏洞	26 Nov 202100:00	–	cnnvd
CNVD	Unspecified vulnerability in html2csv	30 Nov 202100:00	–	cnvd
CVE	CVE-2021-23654	26 Nov 202120:05	–	cve
Cvelist	CVE-2021-23654 Improper Input Validation	26 Nov 202120:05	–	cvelist
EUVD	EUVD-2021-0097	7 Oct 202500:30	–	euvd
NVD	CVE-2021-23654	26 Nov 202120:15	–	nvd
OSV	GHSA-FWF6-RW69-HHJ4 Improper Neutralization of Formula Elements in a CSV File in html-2-csv	30 Nov 202122:22	–	osv
OSV	PYSEC-2021-866	26 Nov 202120:15	–	osv
Prion	Design/Logic Flaw	26 Nov 202120:15	–	prion
PyPA	PYSEC-2021-866	26 Nov 202120:15	–	pypa

Vulners

Node

html-to-csv_project html-to-csvRange≤0.1.3pip

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-23654
snyk	www.snyk.io/vuln/SNYK-PYTHON-HTMLTOCSV-1582784
github	www.github.com/hanwentao/html2csv/issues/9
github	www.github.com/advisories/GHSA-fwf6-rw69-hhj4
github	www.github.com/hanwentao/html2csv/blob/master/html2csv/converter.py
github	www.github.com/pypa/advisory-database/tree/main/vulns/html-to-csv/PYSEC-2021-866.yaml

20 Sep 2024 21:51Current

2.9Low risk

Vulners AI Score2.9

CVSS 27.5

CVSS 3.15.6 - 9.8

EPSS0.01182

CWE-1236