CVE-2023-54348 ERPGo SaaS 3.9 CSV Injection via Vendor Creation
Authenticated attackers can inject malicious spreadsheet formulas into vendor fields, leading to code execution when exported CSVs are opened.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-54348?
CVE-2023-54348 is a high-severity code injection vulnerability in Rajodiya ERPGo SaaS, published on 5 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ERPGo SaaS 3.9 contains a CSV injection vulnerability that allows authenticated attackers to inject spreadsheet formulas into vendor name fields that execute on the workstation of users who open the exported CSV in a spreadsheet application. Attackers can add malicious formulas like =10+20+cmd|' /C calc'!A0 in the vendor creation form, which execute when the exported CSV file is opened in spreadsheet applications.
Weakness: CWE-1236
Which versions are affected by CVE-2023-54348?
How do I fix CVE-2023-54348?
No fix has been published for CVE-2023-54348 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-54348 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-54348 exists.
Sources
Also known as GHSA-h3v8-v9f6-ffjp.