CVE-2026-19501
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on an administrator's workstation when the exported CSV file is opened in a vulnerable spreadsheet application.
Risk Assessment
The risk is the possibility of executing malicious formulas in the administrator's spreadsheet, which could lead to data theft, malware infection, or other attacks after opening the CSV file.
Recommendation
It is recommended to update the SureForms plugin to a version newer than 2.12.1 that includes a fix neutralizing formula characters, and to exercise caution when opening CSV files from unknown sources.
Original NVD description (English source)
CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on an administrator's workstation when the exported CSV file is opened in a vulnerable spreadsheet application.