CVE-2017-15879 describes a CSV Injection vulnerability in KeystoneJS versions prior to 4.0.0-beta.7, specifically within the admin/server/api/download.js and lib/list/getCSVData.js components. This flaw allows an attacker to embed malicious formulas into CSV exports, which can then be executed when opened in spreadsheet software. Rated with a CVSS score of 8.8 (High), this vulnerability has a low attack complexity and can lead to high impact on confidentiality, integrity, and availability if a user opens a crafted CSV file. While not actively exploited in the wild or on the KEV catalog, public exploit code exists on ExploitDB, and it has garnered minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 4.0.0CPE matchmatch criteria | cpe:2.3:a:keystonejs:keystone:*:beta5:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.