CVE-2022-37786 Code injection in n/a

Medium 6.3 Published 1 Jan 2023 Updated 11 Apr 2025

Attackers can inject malicious formulas into CSV exports in WeCube Platform, potentially executing code when files are opened in spreadsheet software.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2022-37786?

CVE-2022-37786 is a medium-severity code injection vulnerability in n/a, published on 1 Jan 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An issue was discovered in WeCube Platform 3.2.2. There are multiple CSV injection issues: the [Home / Admin / Resources] page, the [Home / Admin / System Params] page, and the [Home / Design / Basekey Configuration] page.

Weakness: CWE-1236

Which versions are affected by CVE-2022-37786?

It affects 1 product.

Products include Wecube-Platform Project Wecube-Platform.

How do I fix CVE-2022-37786?

No fix has been published for CVE-2022-37786 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2022-37786 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-37786 exists.

Sources

Also known as GHSA-xp88-ch9m-fp9x.