Formula Injection in Exported Data - inventree
Summary
GHSA-7rq4-qcpw-74gq: Formula Injection in Exported Data. Affects inventree versions < 0.7.2. Fixed in 0.7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
inventree is a Python package available on PyPI that provides functionality for managing inventory and stock control. It is designed to help businesses keep track of their products, parts, and assemblies. However, inventree is vulnerable to a formula injection vulnerability when exporting datasets to file formats like CSV or XLS. This vulnerability arises due to insufficient sanitization of the exported data, which can allow an attacker to inject malicious formulas into the exported file.
Vulnerability Detail
The formula injection vulnerability in inventree can have several ramifications. An attacker could craft a malicious formula that, when opened in software like Microsoft Excel, could execute arbitrary code or perform unintended actions. This could lead to data manipulation, unauthorized access, or even remote code execution. The vulnerability is considered moderate in severity.
How To Fix
Minimum fixed version
0.7.2
This is the first release that contains the fix.
pip install --upgrade "inventree==0.7.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To mitigate the risk of formula injection, users exporting untrusted data can follow these steps:
- Open the exported file in safe mode, such as in Microsoft Excel.
- Verify that the exported data does not contain any unexpected formulas or functions.
- If any suspicious formulas are found, remove or disable them before further processing the file.
Conclusion
The formula injection vulnerability in inventree can have serious consequences, including data manipulation and unauthorized access. It is important to update to the latest version of inventree or apply the provided fix to mitigate this vulnerability. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for inventree →
FAQ
inventree is a Python package that provides inventory and stock control functionality for businesses.
Formula injection is a type of vulnerability where an attacker can inject malicious formulas into a file, which can be executed when the file is opened in software like Microsoft Excel.
Formula injection in inventree can lead to data manipulation, unauthorized access, and even remote code execution.
The formula injection vulnerability has been fixed in the upcoming 0.8.0 release of inventree. Users should update to this version or apply the fix back-ported to the 0.7.2 release.
Users exporting untrusted data can open the exported files in safe mode, such as in Microsoft Excel, to mitigate the risk of formula injection.
References
Related vulnerabilities
Recent vulnerabilities recorded for inventree.
