Keystone is vulnerable to CSV injection

published 2017-10-24 9 y ago modified 2026-06-17 4 mo ago also GHSA-6494-v9fq-fgq2 , EUVD-2017-0343

cvss: 8.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 7.2%; EPSS 7.2% chance of exploitation in 30 days, percentile 94%
public exploits: 1; Exploit-DB

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export.

Patch / fix

fixed in 1 links 1

npm keystone 4.0.0-beta7

github.com/keystonejs/keystone#4478 pull request

Timeline

2017-10-24 Published
2017-10-25 First public exploit (EDB-43053)

Exploit prediction

7.22% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-43053 KeystoneJS 4.0.0-beta.5 - CSV Excel Macro Injection webapps, 2017-10-25

CVSS scores

assigned by	version	score	vector
NVD	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P
GitHub	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	keystone	<4.0.0-beta7	4.0.0-beta7

Classification

Weakness

CWE-20 Improper Input Validation

References

github.com /keystonejs/keystone/pull/4478
web, issue-tracking, patch, third-party-advisory
exploit-db.com /exploits/43053/
exploit, third-party-advisory, vdb-entry
packetstormsecurity.com /files/144755/KeystoneJS-4.0.0-beta.5-Unauthenticated-CSV-Injection.html
web, third-party-advisory, vdb-entry
nvd.nist.gov /vuln/detail/CVE-2017-15879
advisory
github.com /advisories/GHSA-6494-v9fq-fgq2
advisory
exploit-db.com /exploits/43053
web

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary