GHSA-663j-rjcr-789fHighCVSS 8.0

CSV injection in shuup

Published
September 30, 2021
Last Modified
October 23, 2024

🔗 CVE IDs covered (1)

CVE-2021-25962 →

📋 Description

“Shuup” application in versions 0.4.2 to 2.10.8 is affected by the “Formula Injection” vulnerability. A customer can inject payloads in the name input field in the billing address while buying a product. When a store administrator accesses the reports page to export the data as an Excel file and opens it, the payload gets executed.

🎯 Affected products1

  • pip/shuup:>= 0.4.2, < 2.11.0

🔗 References (5)