HighGHSA-h7vq-5qgw-jwwqCVE-2021-41824

CSV Injection Vulnerability

Published 18 Oct 2021 · Updated 8 Jul 2026

Affected package

craftcms/cmsComposer
Affected
>=3.4.0 <3.7.14
Fixed in
3.7.14
Update to the fixed version for your release line, for example:composer require craftcms/cms:^3.7.14

Details

Impact

In some circumstances, it was possible to export data in CSV format that could trigger a payload in old versions of Excel.

If you are accepting user input from untrusted sources and will be exporting that data in CSV format from element index pages and there is a chance users will open that on old versions of Excel, then you should update.

Patches

This has been patched in Craft 3.7.14.

References

  • https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3714---2021-09-28
  • https://twitter.com/craftcmsupdates/status/1442928690145366018

For more information

If you have any questions or comments about this advisory, email us at support@craftcms.com

----------

Credits: BAE Systems AI Vulnerability Research Team – Azrul Ikhwan Zulkifli

Is GHSA-h7vq-5qgw-jwwq in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected craftcms/cms, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.