CWE-1236Improper Neutralization of Formula Elements in a CSV File

Abstraction: Base · CVEs in our corpus: 303

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

Last updated: 21 August 2026 22:22 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-06
SI-15 Information Output Filtering

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V1.2.10

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2021-33256`	9.1	8.8	0.7900	2021-08-09
`CVE-2018-11652`	8.7	9.8	0.2444	2018-06-01
`CVE-2019-12765`	8.2	9.8	0.1049	2019-06-11
`CVE-2020-36962`	8.2	9.8	0.1068	2026-01-28
`CVE-2020-9347`	8.1	9.8	0.0779	2020-03-16
`CVE-2020-11548`	7.9	9.8	0.0517	2020-04-05
`CVE-2018-20752`	7.8	9.8	0.0343	2019-02-04
`CVE-2020-7947`	7.8	9.8	0.0284	2020-04-01
`CVE-2020-22276`	7.8	9.8	0.0302	2020-11-04
`CVE-2019-4521`	7.7	9.8	0.0261	2019-12-10
`CVE-2019-0403`	7.7	9.8	0.0209	2019-12-11
`CVE-2021-38180`	7.7	9.8	0.0205	2021-10-12
`CVE-2022-0142`	7.7	9.8	0.0269	2022-04-12
`CVE-2018-8092`	7.6	9.8	0.0169	2018-04-18
`CVE-2019-13144`	7.6	9.8	0.0184	2019-07-05
`CVE-2019-16184`	7.6	9.8	0.0171	2019-09-09
`CVE-2020-22274`	7.6	9.8	0.0163	2020-11-04
`CVE-2021-3188`	7.6	9.8	0.0179	2021-01-26
`CVE-2022-26249`	7.6	9.8	0.0188	2022-03-24
`CVE-2022-28481`	7.6	9.8	0.0173	2022-05-01
`CVE-2022-3393`	7.6	9.8	0.0129	2022-10-25
`CVE-2022-3574`	7.6	9.8	0.0132	2022-11-14
`CVE-2020-10131`	7.6	9.8	0.0152	2023-09-06
`CVE-2024-29375`	7.6	9.8	0.0146	2024-04-04
`CVE-2018-9035`	7.5	9.6	0.0744	2018-04-04