{"id":"CVE-2026-129133","aliases":[],"cve":{"records":[{"id":"CVE-2026-129133","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-13T16:01:04.407Z","published":"2026-11-13T16:23:35.501Z","modified":"2026-11-13T16:23:35.501Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-13T16:23:35.501Z"}],"references":[{"url":"https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-9rvp-v4ff-wpwr","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://github.com/meeting-room-booking-system/mrbs-code/commit/92f6f5610072ddb9e1b38074c410fc8be56947ed","tags":["patch"],"source":"VulnCheck"},{"url":"https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.13.0","tags":["release-notes"],"source":"VulnCheck"},{"url":"https://github.com/meeting-room-booking-system/mrbs-code/blob/299686ed64174a66448699f5ca0fb5e0e0ea9faa/web/report.php#L542-L543","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/mrbs-before-1.13.0-csv-formula-injection-via-report-export","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-1236","description":"Improper Neutralization of Formula Elements in a CSV File","source":"VulnCheck"}],"applicability":[],"prioritization":[]},"title":"MRBS before 1.13.0 CSV Formula Injection via Report Export","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape() function in web/report.php fails to neutralize leading formula characters. Attackers can store formulas in booking names, descriptions or custom fields that execute when privileged users open exported CSV reports, enabling data exfiltration or command execution via DDE.","score":5.4,"severity":"medium","published":"2026-11-13T16:23:35.501Z","modified":"2026-11-13T16:23:35.501Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"meeting-room-booking-system","name":"mrbs-code","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"1.13.0","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:github/meeting-room-booking-system/mrbs-code","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-129133"}],"remediation":[],"references":["https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-9rvp-v4ff-wpwr","https://github.com/meeting-room-booking-system/mrbs-code/commit/92f6f5610072ddb9e1b38074c410fc8be56947ed","https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.13.0","https://github.com/meeting-room-booking-system/mrbs-code/blob/299686ed64174a66448699f5ca0fb5e0e0ea9faa/web/report.php#L542-L543","https://www.vulncheck.com/advisories/mrbs-before-1.13.0-csv-formula-injection-via-report-export"],"sources":[{"name":"CVE","id":"CVE-2026-129133","modified":"2026-11-13T16:23:35.501Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-129133"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","score":5.1},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4}],"sourceAffected":[],"observedAt":"2026-11-13T23:54:10.985Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:55:32.844Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-14T03:30:34.932Z","attemptedAt":"2026-11-14T03:30:34.932Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-14T02:30:32.968Z","attemptedAt":"2026-11-14T02:30:32.968Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-14T02:25:35.970Z","attemptedAt":"2026-11-14T02:25:35.970Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-14T02:25:35.385Z","attemptedAt":"2026-11-14T02:25:35.385Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-125546","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125546","modified":"Nov 13, 2026, 4:23:35 PM","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","checkedAt":"2026-11-14T02:25:35.970Z"},{"source":"GitHub Advisory Database","id":"GHSA-jrr2-f5c5-j7qw","url":"https://github.com/advisories/GHSA-jrr2-f5c5-j7qw","modified":"2026-11-13T18:32:33Z","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","checkedAt":"2026-11-14T02:30:32.968Z"},{"source":"NVD","id":"CVE-2026-129133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129133","modified":"2026-11-13T17:17:31.173","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-14T03:30:34.932Z"},{"source":"NVD","id":"CVE-2026-129133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129133","modified":"2026-11-13T17:17:31.173","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","checkedAt":"2026-11-14T03:30:34.932Z"}],"aiSummary":{"text":"MRBS before 1.13.0 has a CSV formula injection vulnerability, allowing authenticated users to inject formulas via booking names or descriptions, which execute when privileged users open exported CSV reports. The weakness is due to the escape() function in web/report.php failing to neutralize leading formula characters. This may enable data exfiltration or command execution.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-14T01:31:01.549Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-129133"}]}}