A critical CSV formula injection vulnerability in Tendenci 12.3.1 allows unauthenticated attackers to achieve arbitrary command execution on systems that process exported contact form data.

This vulnerability involves improper neutralization of input in the contact form message field. An unauthenticated attacker can submit malicious CSV formulas that execute system commands when the exported data is opened by an administrator in a spreadsheet application.

The exploitation of this vulnerability poses a severe risk to organizational security, as it facilitates remote code execution (RCE) on the systems of personnel who process the exported data. Given the CVSS score of 9.8, this represents a critical threat that could lead to full system compromise, data theft, and unauthorized persistence within the internal network.

Immediate Action: Update Tendenci to the latest available version as specified by the vendor's security advisory.

Proactive Monitoring: Inspect contact form submissions for suspicious characters, particularly those starting with '=', '+', '-', or '@', which are indicative of formula injection attempts.

Compensating Controls: Configure spreadsheet applications to disable automatic formula execution and utilize a Web Application Firewall (WAF) to filter malicious payloads from incoming form submissions.

Public Exploit Available: Unknown

This vulnerability is highly severe due to the potential for RCE via simple user input. Administrators must prioritize updating the software and implement strict input validation on all web forms to prevent malicious payloads from being stored or exported.