{"id":"CVE-2021-41824","aliases":["GHSA-h7vq-5qgw-jwwq"],"url":"https://o3.security/vulnerability/CVE-2021-41824","summary":"CSV Injection Vulnerability","details":"### Impact\nIn some circumstances, it was possible to export data in CSV format that could trigger a payload in old versions of Excel.\n\nIf you are accepting user input from untrusted sources and will be exporting that data in CSV format from element index pages and there is a chance users will open that on old versions of Excel, then you should update.\n\n### Patches\nThis has been patched in Craft 3.7.14.\n\n### References\n* https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3714---2021-09-28\n* https://twitter.com/craftcmsupdates/status/1442928690145366018\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at support@craftcms.com\n\n----------\n\nCredits: BAE Systems AI Vulnerability Research Team – Azrul Ikhwan Zulkifli","published":"2021-09-30T00:15:07.490Z","modified":"2026-08-07T16:57:42.853010Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"3.7.14"}],"fix":{"url":"https://github.com/craftcms/cms/commit/c9cb2225f1b908fb1e8401d401219228634b26b2","label":"craftcms/cms@c9cb222"},"references":[{"type":"ADVISORY","url":"https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3714---2021-09-28"},{"type":"ADVISORY","url":"https://github.com/craftcms/cms/security/advisories/GHSA-h7vq-5qgw-jwwq"},{"type":"ADVISORY","url":"https://twitter.com/craftcmsupdates/status/1442928690145366018"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41824"},{"type":"WEB","url":"https://github.com/craftcms/cms/commit/c9cb2225f1b908fb1e8401d401219228634b26b2"},{"type":"PACKAGE","url":"https://github.com/craftcms/cms"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T16:57:42.853010Z"}}