CVE-2017-15879: Keystone CSV Injection Vulnerability
Summary
CVE-2017-15879: Keystone is vulnerable to CSV injection. Affects keystone versions < 4.0.0-beta7. Fixed in 4.0.0-beta7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keystone is an npm package used for building websites and applications. It provides a content management system (CMS) and an application framework. Keystone is vulnerable to CSV injection, also known as Excel Macro Injection or Formula Injection. This vulnerability exists in the 'admin/server/api/download.js' and 'lib/list/getCSVData.js' files in KeystoneJS versions before 4.0.0-beta.7. An attacker can exploit this vulnerability by manipulating a value that is mishandled during a CSV export.
Vulnerability Detail
CSV Injection is a type of vulnerability where an attacker can inject malicious content into a CSV file, which can lead to the execution of arbitrary code or the manipulation of data when the file is opened with a spreadsheet application. In the case of Keystone, this vulnerability allows an attacker to inject malicious formulas or macros into the exported CSV file, potentially compromising the security and integrity of the data.
How To Fix
Latest published version: 4.2.1 as of 22 Oct 2026
npm install keystone@4.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.0-beta7
This is the first release that contains the fix.
npm install keystone@4.0.0-beta7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately possible, a temporary workaround is to manually sanitize the values before exporting them to a CSV file. Ensure that any user-supplied input is properly validated and sanitized to prevent the injection of malicious content. Use appropriate CSV libraries or functions that handle escaping and encoding of special characters to mitigate the risk of CSV injection.
Conclusion
The Keystone CSV injection vulnerability allows an attacker to inject malicious content into exported CSV files, potentially compromising the security and integrity of the data. It is recommended to upgrade to KeystoneJS version 4.0.0-beta.7 or later to fix this vulnerability. If upgrading is not immediately possible, ensure that user-supplied values are properly validated and sanitized before exporting them to a CSV file. Use appropriate CSV libraries or functions that handle escaping and encoding of special characters. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for keystone →
FAQ
CSV injection, also known as Excel Macro Injection or Formula Injection, is a vulnerability that allows an attacker to inject malicious content into a CSV file. When the file is opened with a spreadsheet application, the injected content can be executed or used to manipulate data.
The Keystone CSV injection vulnerability occurs when user-supplied values are not properly sanitized before being exported to a CSV file. An attacker can manipulate these values to inject malicious formulas or macros into the exported file, potentially compromising the security and integrity of the data.
The potential consequences of CSV injection in Keystone include the execution of arbitrary code or the manipulation of data when the exported CSV file is opened with a spreadsheet application. This can lead to unauthorized access, data loss, or the compromise of sensitive information.
To protect your Keystone application from CSV injection, it is recommended to upgrade to the fixed version (4.0.0-beta.7 or later) that includes a patch for the vulnerability. Additionally, ensure that user-supplied values are properly validated and sanitized before exporting them to a CSV file. Use appropriate CSV libraries or functions that handle escaping and encoding of special characters.
Yes, if upgrading to the fixed version is not immediately possible, you can manually sanitize the values before exporting them to a CSV file. Ensure that any user-supplied input is properly validated and sanitized to prevent the injection of malicious content. Use appropriate CSV libraries or functions that handle escaping and encoding of special characters.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
