CVE-2021-23654: Improper Neutralization of Formula Elements in a CSV File

November 30, 2021 (updated December 1, 2021)

This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a malicious link or execute commands via CSV files.

References

github.com/advisories/GHSA-fwf6-rw69-hhj4
github.com/hanwentao/html2csv/blob/master/html2csv/converter.py
nvd.nist.gov/vuln/detail/CVE-2021-23654
snyk.io/vuln/SNYK-PYTHON-HTMLTOCSV-1582784

Code Behaviors & Features

Detect and mitigate CVE-2021-23654 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →