Description
Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.
Scores
CVSS v3
7.8
EPSS
0.0040
EPSS Percentile
60.4%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-1236
Status
published
Products (2)
luya/yii-helpers
< 1.2.1
luyadev/yii-helpers
0 - 1.2.1Packagist
Published
May 01, 2022
Tracked Since
Feb 18, 2026