A critical CSV injection vulnerability in Knockpy 4.1.1 could allow remote attackers to execute arbitrary commands on end-user systems via malicious spreadsheet formulas.

This vulnerability is a CSV injection flaw where the application fails to properly sanitize server response headers. An unauthenticated attacker can inject malicious spreadsheet formulas that execute upon opening the generated report.

The exploitation of this flaw poses a significant risk to organizational data integrity and endpoint security. By leveraging this injection, attackers could potentially gain unauthorized code execution on the machines of users who interact with the generated reports, leading to data exfiltration or system compromise. With a CVSS score of 9.8, this represents a severe threat to any environment utilizing Knockpy for reporting.

Immediate Action: Update Knockpy to the latest available version provided by the vendor to ensure proper input sanitization.

Proactive Monitoring: Review server logs for anomalous header manipulations and scrutinize any generated CSV reports for unexpected formulaic patterns.

Compensating Controls: Advise users to disable automatic formula execution in spreadsheet applications (e.g., Microsoft Excel or LibreOffice) as a temporary safeguard.

Public Exploit Available: Unknown

Given the critical CVSS severity, administrators should prioritize updating the Knockpy installation immediately. Organizations should also implement strict input validation policies for all generated exports to prevent similar injection vectors.