CSV Injection

Overview Affected versions of this package are vulnerable to CSV Injection via the visit export process. An attacker can cause arbitrary spreadsheet formulas to be embedded in exported CSV files by supplying specially crafted values in the User-Agent, Referer, or request path headers that begin...

CVE-2026-18738 Shlink CSV Formula Injection via Visit Export CLI

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering...