CVE-2020-36941
Published: 27 January 2026
Summary
CVE-2020-36941 is a medium-severity Improper Neutralization of Formula Elements in a CSV File (CWE-1236) vulnerability in Guelfoweb Knockpy. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 38.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2020-36941 is a CSV injection vulnerability affecting Knockpy version 4.1.1. The flaw arises from unfiltered server headers, enabling attackers to inject malicious spreadsheet formulas into CSV reports generated by the tool. This issue is classified under CWE-1236 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact exploitation.
The vulnerability can be exploited remotely by any unauthenticated attacker with network access and low complexity requirements. By manipulating server response headers, an attacker injects formulas that execute automatically when a victim opens the CSV report in spreadsheet applications, such as Microsoft Excel or LibreOffice Calc. Successful exploitation could compromise the victim's system through arbitrary code execution, data exfiltration, or other malicious actions embedded in the formulas.
Advisories and related resources, including the Knockpy GitHub repository (https://github.com/guelfoweb/knock), an Exploit-DB entry (https://www.exploit-db.com/exploits/49342), and a Vulncheck advisory (https://www.vulncheck.com/advisories/knockpy-csv-injection), provide details on the issue and potential mitigations, such as updating to a patched version or implementing input sanitization for headers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30859
Vulnerability details
Knockpy 4.1.1 contains a CSV injection vulnerability that allows attackers to inject malicious formulas into CSV reports through unfiltered server headers. Attackers can manipulate server response headers to include spreadsheet formulas that will execute when the CSV is opened in…
more
spreadsheet applications.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSV injection enables malicious formula delivery in generated reports (T1204.002 Malicious File); formulas execute OS commands on open (T1059.003 Windows Command Shell).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE by requiring remediation of the specific flaw in Knockpy 4.1.1 through patching to a version that sanitizes server headers in CSV reports.
Prevents CSV injection by filtering malicious spreadsheet formulas from CSV reports generated using untrusted server header data.
Mitigates exploitation by validating server headers as inputs to ensure they do not contain executable formulas before inclusion in CSV outputs.