Improper neutralization of formula elements in yii-helpers

ALTO 7.8CVE-2022-1544 · GHSA-f9p3-h6cg-2cjr · Published 01/05/2022 · updated 17/06/2026

In breve

CVE-2022-1544 è una vulnerabilità ALTO (CVSS 7.8) che riguarda luyadev/yii-helpers, yii-helpers (luya).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.4%, superiore al 84.0% delle vulnerabilità.
Correzione: aggiornare a 1.2.1 o successiva.

Package	Affected versions	Patched versions
luyadev/yii-helpers Packagist	`< 1.2.1`	`1.2.1`
yii-helpers luya	`< 1.2.1`	`1.2.1`

Description

Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-1544 · ADVISORY
luyadev/yii-helpers commit 9956ed6 · WEB
luyadev/yii-helpers · PACKAGE
huntr.dev/bounties/fa6d6e75-bc7a-40f6-9bdd-2541318912d4 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free