A CSV formula injection vulnerability in Tendenci 12.3.1 allows for potential arbitrary command execution, presenting a critical risk to users who process exported data.

This is a CSV formula injection vulnerability (CWE-1236) where malicious payloads in contact form fields are not properly sanitized. When an administrator exports this data to a CSV file and opens it in a spreadsheet application, the embedded formulas can execute system commands.

The impact of this vulnerability is significant as it leverages the trust of administrative users who frequently interact with exported data. Successful exploitation could lead to full system compromise if an administrator executes a malicious CSV file, potentially resulting in unauthorized access to sensitive institutional data and internal network resources.

Immediate Action: Update to Tendenci version 12.3.2 or later immediately to apply the necessary sanitization patches.

Proactive Monitoring: Audit recent CSV exports for suspicious characters or formulas (e.g., starting with '=', '+', '-', or '@') before opening them in spreadsheet software.

Compensating Controls: Configure administrative systems to disable automatic formula evaluation in spreadsheet software or use a secure "sandbox" environment for opening files exported from external platforms.

Public Exploit Available: Yes — an ExploitDB entry (49145) exists.

Organizations utilizing Tendenci should prioritize upgrading to version 12.3.2 without delay. Security teams should also emphasize user awareness training regarding the risks of opening files from untrusted sources, even if they originate from internal administrative exports.