Formula Injection in Exported Data

中GHSA-7rq4-qcpw-74gq · 17/06/2022 公開 · 08/12/2024 更新

要点

パッケージ	影響を受けるバージョン	修正済みバージョン
inventree PyPI	`< 0.7.2`	`0.7.2`

Datasets exported to file (e.g. CSV / XLS) are not sufficiently sanitized, to neutralize potential formula injection

The issue is addressed in the upcoming 0.8.0 release
This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release

Users exporting untrusted data should open the files in safe mode (e.g. in Microsoft Excel).

If you have any questions or comments about this advisory:

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

パッケージ

影響を受けるバージョン

修正済みバージョン

PyPI

< 0.7.2

0.7.2

概要

Datasets exported to file (e.g. CSV / XLS) are not sufficiently sanitized, to neutralize potential formula injection

The issue is addressed in the upcoming 0.8.0 release
This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release

Users exporting untrusted data should open the files in safe mode (e.g. in Microsoft Excel).

If you have any questions or comments about this advisory:

inventree のその他の脆弱性

すべて見る →