A CSV injection vulnerability in Dirsearch 0.4.1 enables attackers to execute malicious formulas through manipulated reports, posing a risk to data integrity.

This is a CSV injection vulnerability triggered when the user utilizes the --csv-report flag. An attacker can craft malicious server redirects containing Excel formulas, which are then improperly processed by spreadsheet software when the generated report is opened.

While the CVSS score is 9.8, the business impact is primarily focused on the compromise of the client-side environment where the CSV is opened. If security analysts or administrators open these reports in vulnerable spreadsheet applications, they could be subject to unauthorized command execution, leading to local data theft or system compromise.

Immediate Action: Update to the latest version of Dirsearch and avoid opening CSV reports from untrusted or unverified sources.

Proactive Monitoring: Review generated CSV files for suspicious formula characters (e.g., =, +, -, @) before importing them into spreadsheet software.

Compensating Controls: Configure spreadsheet software to disable automated macro execution and data connections to prevent the automatic triggering of injected formulas.

Public Exploit Available: Unknown

Users of Dirsearch should update immediately to address this injection flaw. Organizations should enforce internal policies regarding the handling of exported reports to ensure that sensitive data is not exposed to execution risks during analysis.