Vulnerability Description
CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on an administrator's workstation when the exported CSV file is opened in a vulnerable spreadsheet application.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- http://sureforms.com
- https://github.com/typedefabcd1234ntd/CVE-2026-19501-poc
- https://github.com/typedefabcd1234ntd/CVE-2026-19501-poc
FAQ
What is CVE-2026-19501?
CVE-2026-19501 is a vulnerability with a CVSS score of 8.8 (HIGH). CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which a...
How severe is CVE-2026-19501?
CVE-2026-19501 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-19501?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.