CyberRota Analysis
AI-GeneratedMicrosoft Office's TypeBot version 3.16.1 is vulnerable to a critical CSV injection flaw that allows attackers to inject malicious spreadsheet formulas through unsanitized user input in the result export functionality. This vulnerability poses a significant risk, as it can lead to the execution of arbitrary code when an administrator opens the compromised CSV file in spreadsheet applications. Organizations using this version should prioritize upgrading to version 3.17.0 to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or escape user-supplied input when generating CSV files. An attacker can inject spreadsheet formulas into input fields, which are later executed when an administrator opens the exported CSV in spreadsheet software such as Microsoft Excel or LibreOffice Calc. Version 3.17.0 patches the issue.