CVE-2025-11498 CSV Formula Injection Vulnerability
Remote attackers can inject malicious formulas into CSV files via crafted links, potentially leading to code execution when users open the file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-11498?
CVE-2025-11498 is a medium-severity vulnerability in B&R Industrial Automation GmbH Automation Runtime, published on 14 Oct 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 enabling a remote attacker to inject formula data into a generated CSV file. The exploitation of this vulnerability requires the attacker to create a malicious link. The user would need to click on this link, after which the resulting CSV file addi-tionally needs to be manually opened.
Weakness: CWE-1236
Which versions are affected by CVE-2025-11498?
How do I fix CVE-2025-11498?
No fix has been published for CVE-2025-11498 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-11498 being exploited?
There is no known exploitation of CVE-2025-11498 in the wild and no public exploit code.
Sources
Also known as GHSA-m4wh-62fq-hgh7.