CVE-2021-23654: Improper Neutralization of Formula Elements in a CSV File in html-2-csv
(updated )
This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a malicious link or execute commands via CSV files.
References
- github.com/advisories/GHSA-fwf6-rw69-hhj4
- github.com/hanwentao/html2csv
- github.com/hanwentao/html2csv/blob/master/html2csv/converter.py
- github.com/hanwentao/html2csv/issues/9
- github.com/pypa/advisory-database/tree/main/vulns/html-to-csv/PYSEC-2021-866.yaml
- nvd.nist.gov/vuln/detail/CVE-2021-23654
- snyk.io/vuln/SNYK-PYTHON-HTMLTOCSV-1582784
Code Behaviors & Features
Detect and mitigate CVE-2021-23654 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →