---
title: "CSV Formula Injection in Customer Export"
url: https://daily.dev/posts/csv-formula-injection-in-customer-export-6wcrlgmld
source_url: https://rubysec.com/advisories/GHSA-xf4v-w5x5-pv79
type: article
source: "RUBYLAND"
published: 2026-06-06T17:24:04.232Z
updated: 2026-06-06T17:24:22.605Z
tags: ["ruby", "ecommerce"]
reading_time: 1
upvotes: 1
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# CSV Formula Injection in Customer Export

**[RUBYLAND](https://daily.dev/sources/rubyla)** · 1 min read · 1 upvotes · 0 comments

## Summary

A CSV formula injection vulnerability (GHSA-xf4v-w5x5-pv79, CWE-1236) has been disclosed in the Spree e-commerce gem. User-controlled fields such as customer names, email addresses, and shipping addresses are not sanitized before being written to CSV exports. When an administrator opens the exported file in Microsoft Excel or LibreOffice Calc, embedded formulas can execute in the administrator's desktop context, potentially enabling data exfiltration or OS command execution via DDE. Patched versions are 5.2.8, 5.3.6, and 5.4.3. Versions below 5.2.0 are unaffected.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://rubysec.com/advisories/GHSA-xf4v-w5x5-pv79>

## Similar posts on daily.dev

- [Ancient Excel bug comes out of retirement for active attacks](https://daily.dev/posts/ancient-excel-bug-comes-out-of-retirement-for-active-attacks-rfkobowbl) · The Register · 0 upvotes · 0 comments
- [Private exports can be downloaded through reusable links](https://daily.dev/posts/private-exports-can-be-downloaded-through-reusable-links-aewcqn8ul) · RUBYLAND · 0 upvotes · 0 comments
- [CVE-2026-73330 \(camaleon\_cms\): CamaleonCMS 2.9.1 Server-Side Template Injection via test\_email Action](https://daily.dev/posts/cve-2026-73330-camaleon-cms-camaleoncms-2-9-1-server-side-template-injection-via-test-email-actio-op3ubcy08) · RUBYLAND · 1 upvotes · 0 comments

---

Tags: [#ruby](https://daily.dev/tags/ruby), [#ecommerce](https://daily.dev/tags/ecommerce)

[View this post on daily.dev](https://daily.dev/posts/csv-formula-injection-in-customer-export-6wcrlgmld)