CVE-2025-55745: UnoPim CSV Injection Vulnerability in Quick Export Feature
Summary
CVE-2025-55745: UnoPim has CSV Injection on Quick Export feature. Affects unopim/unopim versions < 0.3.1. Fixed in 0.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
UnoPim is a package available on Packagist that provides functionalities for managing product information in a user-friendly manner. It allows users to edit product details and export them in various formats, including CSV. However, the package is vulnerable to CSV Injection, which can lead to severe security risks when malicious content is inserted into exported CSV files.
Vulnerability Detail
The vulnerability arises from the way UnoPim handles user input in fields that are exported to CSV format. Specifically, if a user inputs a formula or command that starts with characters like '=', '+', '-', or '@', it can be interpreted as a formula by spreadsheet applications like Microsoft Excel. This can lead to arbitrary code execution on the victim's machine when the CSV file is opened. Attackers can exploit this vulnerability to execute malicious scripts, potentially compromising the victim's system.
How To Fix
Minimum fixed version
0.3.1
This is the first release that contains the fix.
composer require unopim/unopim:0.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid starting values in any fields that are exported with characters that could be interpreted as formulas. Additionally, sanitize user input using regular expressions or standard libraries to prevent malicious content from being inserted. For fields that cannot be sanitized, wrap the values in double quotes to treat them as plain text.
Conclusion
The CVE-2025-55745 vulnerability in the UnoPim package poses significant risks due to CSV Injection, allowing attackers to execute arbitrary code on victims' machines. It is crucial to update to the patched version or implement workarounds to mitigate these risks.
See every vulnerability recorded for unopim/unopim →
FAQ
CSV Injection, also known as Formula Injection, occurs when malicious content is inserted into a CSV file, which is then interpreted as a formula by spreadsheet applications.
An attacker can input a formula that, when the CSV file is opened, executes arbitrary code on the victim's machine, potentially leading to a reverse shell or other malicious actions.
Any user of the UnoPim package who has the ability to edit product information and export it to CSV is at risk, especially if they open the exported files in spreadsheet applications.
If an immediate update is not possible, implement input sanitization and avoid using characters that could trigger formula execution in CSV files as a temporary measure.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Without needing to sign up, you can check your application against this vulnerability using the Vulert playground at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for unopim/unopim.
