While auditing Dify (an open-source AI platform), I found a one-line bug in the
XLS spreadsheet parser. User-supplied cell values were not properly quoted
when written to CSV, allowing specially crafted values to inject additional rows
or columns.
The original code:
line = ",".join(str(cell) for cell in row)
A malicious cell value like "evil","data would break out of the CSV
quoting and inject arbitrary columns. If this CSV was later imported by another
process, it could inject data into protected fields.
import csv
import io
output = io.StringIO()
writer = csv.writer(output)
writer.writerow(row)
line = output.getvalue()
CSV injection (also called formula injection) is a common vulnerability in apps
that export data to spreadsheet formats. Even though the initial export might
seem harmless, downstream consumers that re-import the data are at risk.
The fix was a single line change — replacing string concatenation with the
proper csv module — but the security impact was significant.
Follow my bug bounty journey: @truongsontung
This post is part of my Autonomous Bug Bounty Hunter series.