{"id":"GHSA-h7vq-5qgw-jwwq","aliases":["CVE-2021-41824"],"title":"CSV Injection Vulnerability","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"### Impact\nIn some circumstances, it was possible to export data in CSV format that could trigger a payload in old versions of Excel.\n\nIf you are accepting user input from untrusted sources and will be exporting that data in CSV format from element index pages and there is a chance users will open that on old versions of Excel, then you should update.\n\n### Patches\nThis has been patched in Craft 3.7.14.\n\n### References\n* https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3714---2021-09-28\n* https://twitter.com/craftcmsupdates/status/1442928690145366018\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at support@craftcms.com\n\n----------\n\nCredits: BAE Systems AI Vulnerability Research Team – Azrul Ikhwan Zulkifli","severity":"high","score":8.8,"published":"2021-10-18T19:04:16.000Z","modified":"2026-07-08T06:30:00.010Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"craftcms/cms","sources":[{"name":"OSV · GHSA-h7vq-5qgw-jwwq","url":"https://osv.dev/vulnerability/GHSA-h7vq-5qgw-jwwq"}],"ranges":[{"events":[{"introduced":"3.4.0"},{"fixed":"3.7.14"}],"type":"ECOSYSTEM"}],"versions":["3.4.0","3.4.0.1","3.4.0.2","3.4.1","3.4.10","3.4.10.1","3.4.11","3.4.12","3.4.13","3.4.14","3.4.15","3.4.16","3.4.17","3.4.17.1","3.4.18","3.4.19","3.4.19.1","3.4.2","3.4.20","3.4.21","3.4.22","3.4.22.1","3.4.23","3.4.24","3.4.25","3.4.26","3.4.27","3.4.28","3.4.28.1","3.4.29","3.4.29.1","3.4.3","3.4.30","3.4.4","3.4.4.1","3.4.5","3.4.6","3.4.6.1","3.4.7","3.4.7.1","3.4.8","3.4.9","3.5.0","3.5.0-RC1","3.5.0-RC1.1","3.5.0-RC2","3.5.0-RC3","3.5.0-RC4","3.5.0-RC5","3.5.0-RC6","3.5.0-beta.1","3.5.0-beta.2","3.5.0-beta.3","3.5.1","3.5.10","3.5.10.1","3.5.11","3.5.11.1","3.5.12","3.5.12.1","3.5.13","3.5.13.1","3.5.13.2","3.5.14","3.5.15","3.5.15.1","3.5.16","3.5.17","3.5.17.1","3.5.18","3.5.19","3.5.19.1","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9","3.6.0","3.6.0-RC1","3.6.0-RC2","3.6.0-RC2.1","3.6.0-RC3","3.6.0-RC4","3.6.0-beta.1","3.6.0-beta.1.1","3.6.0-beta.2","3.6.0.1","3.6.1","3.6.10","3.6.11","3.6.11.1","3.6.11.2","3.6.12","3.6.12.1","3.6.13","3.6.14","3.6.15","3.6.16","3.6.17","3.6.18","3.6.2","3.6.3","3.6.4","3.6.4.1","3.6.5","3.6.5.1","3.6.6","3.6.7","3.6.8","3.6.9","3.7.0","3.7.0-beta.1","3.7.0-beta.2","3.7.0-beta.3","3.7.0-beta.4","3.7.0-beta.5","3.7.0-beta.6","3.7.1","3.7.10","3.7.11","3.7.12","3.7.13","3.7.2","3.7.3","3.7.3.1","3.7.3.2","3.7.4","3.7.5","3.7.6","3.7.7","3.7.8","3.7.9"],"fixed":["3.7.14"]}],"sourceAffected":[],"references":["https://github.com/craftcms/cms/security/advisories/GHSA-h7vq-5qgw-jwwq","https://nvd.nist.gov/vuln/detail/CVE-2021-41824","https://github.com/craftcms/cms/commit/c9cb2225f1b908fb1e8401d401219228634b26b2","https://github.com/craftcms/cms","https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3714---2021-09-28","https://twitter.com/craftcmsupdates/status/1442928690145366018"],"sources":[{"name":"OSV","id":"GHSA-h7vq-5qgw-jwwq","modified":"2026-07-08T06:30:00.010922240Z","url":"https://osv.dev/vulnerability/GHSA-h7vq-5qgw-jwwq"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T20:30:32.749Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}