Keystone is vulnerable to CSV injection (GHSA-6494-v9fq-fgq2)
Published: 2017-11-16T01:46:50Z
Aliases: CVE-2017-15879
Severity: HIGH · CWE: CWE-20

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export.

Affected packages:
package: ecosystem: npm
name: keystone
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.0.0-beta7
database_specific: last_known_affected_version_range: <= 4.0.0-beta5