CVE-2021-41128

    Dashboard / Vulnerabilities / CVE-2021-41128

    CVE-2021-41128

    Published: 6 Oct 2021Last Modified: 9 Jul 2026

    Summary:

    Details: Hygeia is an application for collecting and processing personal and case data in connection with communicable diseases. In affected versions all CSV Exports (Statistics & BAG MED) contain a CSV Injection Vulnerability. Users of the system are able to submit formula as exported fields which then get executed upon ingestion of the exported file. There is no validation or sanitization of these formula fields and so malicious may construct malicious code. This vulnerability has been resolved in version 1.30.4. There are no workarounds and all users are advised to upgrade their package.

    References: https://github.com/beatrichartz/csv/pull/104, https://owasp.org/www-community/attacks/CSV_Injection, https://github.com/beatrichartz/csv/issues/103, https://github.com/jshmrtn/hygeia/commit/d917f27432fe84e1c9751222ae55bae36a4dce60, https://github.com/jshmrtn/hygeia/security/advisories/GHSA-8pwv-jhj2-2369

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 30ed8b39da3fd46ab689f0830e0bbcdafaa1fc17
    Fixed -04700b898edefbd9591b405a52a3c527affc67a7

    Affected versions

    v1.30.4-beta.1
    v1.30.3
    v1.30.3-beta.1
    v1.30.2
    v1.30.2-beta.1
    v1.30.1
    v1.30.1-beta.2
    v1.30.1-beta.1
    v1.30.0
    v1.30.0-beta.6
    v1.30.0-beta.5
    v1.30.0-beta.4
    v1.30.0-beta.3
    v1.30.0-beta.2
    v1.30.0-beta.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-41128 | CVE-DB