SOPlanning code-related vulnerabilities

SOPlanning is a set of online project management software developed by SOPlanning Company. Versions of SOPlanning 1.55 and earlier had code vulnerabilities. These vulnerabilities stemmed from an unvalidated validation of file extensions during upload. This allowed authenticated attackers to uploa...

WS-2023-0097

A CSV Injection in CSV files is generated by the backend in limesurvey/limesurvey prior to 5.6.12...

WS-2022-0345

CSV Injection in CSV files generated by the backend in snipe/snipe-it. Formula Elements are not sanitized before adding to CSV reports. This leads to CSV formula injection...

CVE-2026-7621

The SMTP2GO for WordPress – Email Made Easy plugin (WordPress) is vulnerable in all versions up to 1.16.0 due to improper authorization checks. Authenticated users with subscriber-level access or higher can truncate SMTP log records or export sensitive log data (recipient/sender addresses, subjec...

CVE-2026-7621

The SMTP2GO for WordPress – Email Made Easy plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.16.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers,...

@andrewcturing/todoist (0.0.1), @bento-core/navigator (1.0.0) +57 more potentially affected by CVE-2026-9673 via json-2-csv (>=3.20.0, <=5.5.10)

json-2-csv NPM version =3.20.0, =1.8.0, =5.0.2, =0.0.1, =0.2.3, =0.1.0, =0.1.0, =0.5.1, =1.0.2, =1.3.1, =1.3.1-next.0, =1.4.0, =2.0.4 and more Source cves: CVE-2026-9673 Source advisory: OSV:GHSA-G27C-Q7CP-MHX6...

json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications...

GHSA-G27C-Q7CP-MHX6 json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications...

@andrewcturing/todoist (0.0.1), @bento-core/navigator (1.0.0) +57 more potentially affected by CVE-2026-9673 via json-2-csv (>=3.20.0, <=5.5.10)

json-2-csv NPM version =3.20.0, =1.8.0, =5.0.2, =0.0.1, =0.2.3, =0.1.0, =0.1.0, =0.5.1, =1.0.2, =1.3.1, =1.3.1-next.0, =1.4.0, =2.0.4 and more Source cves: CVE-2026-9673 Source advisory: GHSA-G27C-Q7CP-MHX6...

CVE-2026-9673

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications...

CVE-2026-9673

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications...

CVE-2026-9673

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications...

CVE-2026-9673

CVE-2026-9673 affects json-2-csv versions 3.15.0 and earlier up to 5.5.11, vulnerable to CSV Injection via the preventCsvInjection option, which can be bypassed. An attacker can inject formulas into CSV files that execute when opened in spreadsheet apps. The SNYK entry describes a PoC and recomme...

CVE-2026-9673

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications...

EUVD-2026-32721

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications...

CVE-2026-9673

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications...

CVE-2026-9673

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications...

@andrewcturing/todoist (0.0.1), @bento-core/navigator (1.0.0) +57 more potentially affected by CVE-2026-9673 via json-2-csv (>=3.20.0, <=5.5.10)

json-2-csv NPM version =3.20.0, =1.8.0, =5.0.2, =0.0.1, =0.2.3, =0.1.0, =0.1.0, =0.5.1, =1.0.2, =1.3.1, =1.3.1-next.0, =1.4.0, =2.0.4 and more Source cves: CVE-2026-9673 Source advisory: MEND:CVE-2026-9673...

json-2-csv security vulnerabilities

json-2-csv is a JSON-to-CSV conversion tool developed by Michael Rodrigues. Versions of json-2-csv from 3.15.0 to 5.5.11 had security vulnerabilities. These vulnerabilities stemmed from the possibility of bypassing the preventCsvInjection option, allowing attackers to inject formulas into the CSV...

PT-2026-44192

Name of the Vulnerable Software and Affected Versions json-2-csv versions 3.15.0 through 5.5.10 Description CSV Injection occurs when the preventCsvInjection option is bypassed, allowing an attacker to inject formulas into CSV files. These formulas execute automatically when the files are opened ...