CVE-2020-36941 Knockpy 4.1.1 - CSV Injection
Attackers can inject malicious formulas into CSV reports via unfiltered server headers, leading to code execution when the file is opened in spreadsheet software.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-36941?
CVE-2020-36941 is a medium-severity code injection vulnerability in guelfoweb knock, published on 27 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Knockpy 4.1.1 contains a CSV injection vulnerability that allows attackers to inject malicious formulas into CSV reports through unfiltered server headers. Attackers can manipulate server response headers to include spreadsheet formulas that will execute when the CSV is opened in spreadsheet applications.
Weakness: CWE-1236
Which versions are affected by CVE-2020-36941?
It affects 1 product.
Products include Guelfoweb Knockpy.
How do I fix CVE-2020-36941?
No fix has been published for CVE-2020-36941 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-36941 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36941 exists.
Sources
Also known as GHSA-x2h4-97pf-v2rr.