CVE-2022-39217

    Dashboard / Vulnerabilities / CVE-2022-39217

    CVE-2022-39217

    Published: 16 Sept 2022Last Modified: 27 Aug 2026

    Summary: Improper Neutralization of Formula Elements in a CSV File in ghas-to-csv

    Details: some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom field contains executable code / formulas, it might be run when an endpoint opens that CSV file in a spreadsheet program. This issue has been addressed in version `v1`. Users are advised to use `v1` or later. There are no known workarounds for this issue.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39217.json, https://github.com/some-natalie/ghas-to-csv/security/advisories/GHSA-634p-93h9-92vh, https://nvd.nist.gov/vuln/detail/CVE-2022-39217, https://github.com/some-natalie/ghas-to-csv/commit/d0b521928fa734513b5cd9c7d9d8e09db50e884a

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -d0b521928fa734513b5cd9c7d9d8e09db50e884a

    Affected versions

    v0.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-39217 | CVE-DB