A CSV injection vulnerability in Knockpy 4.1.1 could allow attackers to execute malicious formulas by manipulating server headers captured in scan reports.

This is a CWE-1236 Improper Neutralization of Formula Elements vulnerability. An unauthenticated attacker can influence server headers, which are subsequently written into CSV reports without adequate sanitization, leading to formula execution.

Successful exploitation poses a risk to the security of the analyst's workstation or any system used to review the generated scan reports. If an attacker successfully injects a malicious formula, they could potentially trigger unauthorized commands or exfiltrate local data when the CSV file is opened, impacting the confidentiality and integrity of the user's environment.

Immediate Action: Upgrade to the latest version of the knockpy tool, as the maintainers have implemented necessary sanitization to prevent formula injection.

Proactive Monitoring: Inspect scan reports for suspicious formulaic content in the header fields if immediate patching is not feasible.

Compensating Controls: Utilize security settings in spreadsheet applications to prompt for confirmation before executing external data links or formulas in CSV files.

Public Exploit Available: Yes — an entry exists on ExploitDB (49342).

Organizations using Knockpy 4.1.1 must update to the latest release to eliminate this vulnerability. Until updates are applied, analysts should treat generated CSV files as untrusted and exercise caution when opening them in spreadsheet software.