CSV formula injection (also known as formula injection or CSV injection) affects customer export. User-controlled values customer names, email addresses, and shipping addresses. When an administrator opens a crafted Export in Microsoft Excel or LibreOffice Calc, formulas embedded in user data execute in the context of the administrator's desktop, potentially exfiltrating data or executing OS commands via DDE (Dynamic Data Exchange).

Impact

Vulnerability class: CSV / Formula Injection (CWE-1236)

Who is impacted

Administrators who download and open export files in spreadsheet software are the direct victims. Administrative accounts have access to all store data, payment method configurations, customer PII, and full order history.