CWE · MITRE source
CWE-1236Improper Neutralization of Formula Elements in a CSV File
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: full · 4 mapping(s) from 2 framework(s): ATT&CK 3 (mostly) · ASVS 5.0 1 (full)
NIST 800-53 r5 controls that address this weakness (0)AI
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
MITRE ATT&CK techniques this weakness enables
Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial).
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2021-33256 | 8.0 | 8.8 | 0.7900 | 2021-08-09 |
CVE-2018-9035 | 7.0 | 9.6 | 0.0774 | 2018-04-04 |
CVE-2018-8092 | 7.0 | 9.8 | 0.0169 | 2018-04-18 |
CVE-2018-11652 | 7.0 | 9.8 | 0.2473 | 2018-06-01 |
CVE-2018-15474 | 7.0 | 9.6 | 0.0333 | 2018-09-07 |
CVE-2018-20752 | 7.0 | 9.8 | 0.0343 | 2019-02-04 |
CVE-2019-12765 | 7.0 | 9.8 | 0.1049 | 2019-06-11 |
CVE-2019-13144 | 7.0 | 9.8 | 0.0184 | 2019-07-05 |
CVE-2019-16184 | 7.0 | 9.8 | 0.0171 | 2019-09-09 |
CVE-2019-4521 | 7.0 | 9.8 | 0.0261 | 2019-12-10 |
CVE-2019-0403 | 7.0 | 9.8 | 0.0209 | 2019-12-11 |
CVE-2020-9347 | 7.0 | 9.8 | 0.0779 | 2020-03-16 |
CVE-2019-19676 | 7.0 | 9.6 | 0.0129 | 2020-03-18 |
CVE-2020-7947 | 7.0 | 9.8 | 0.0284 | 2020-04-01 |
CVE-2020-11548 | 7.0 | 9.8 | 0.0517 | 2020-04-05 |
CVE-2020-22276 | 7.0 | 9.8 | 0.0298 | 2020-11-04 |
CVE-2020-22274 | 7.0 | 9.8 | 0.0161 | 2020-11-04 |
CVE-2020-4627 | 7.0 | 9.0 | 0.0159 | 2020-11-30 |
CVE-2021-3188 | 7.0 | 9.8 | 0.0179 | 2021-01-26 |
CVE-2021-38180 | 7.0 | 9.8 | 0.0199 | 2021-10-12 |
CVE-2022-26249 | 7.0 | 9.8 | 0.0176 | 2022-03-24 |
CVE-2022-0142 | 7.0 | 9.8 | 0.0269 | 2022-04-12 |
CVE-2022-28481 | 7.0 | 9.8 | 0.0168 | 2022-05-01 |
CVE-2022-3393 | 7.0 | 9.8 | 0.0128 | 2022-10-25 |
CVE-2022-22425 | 7.0 | 9.8 | 0.0109 | 2022-11-03 |