From the 2MNY engineering team

#CWE-1236

All security articles tagged "CWE-1236" — vulnerability deep-dives, scanner guides and hardening checklists from the 2MNY team.

← All articles

All AI & LLM Security 1 API Security 2 Attack Surface 3 DNS Security 2 HTTP Headers 1 Monitoring 2 OWASP 4 Product Updates 6 Small Business 1 SSL/TLS 1 Supply Chain Security 2 Threat Intelligence 2 Website Security 7 WordPress Security 1

Website Security

CSV Formula Injection: The Spreadsheet That Opens a Command Prompt

Your export endpoint writes user-controlled strings into CSV cells. When a cell starts with =, @, +, -, or a tab, Excel and friends treat it as code — and a crafted cell can chain DDE into a command prompt on the analyst's machine. Here's the two-sided detection: planted formula cells already present, and the reflection vector that lets attackers plant them — proven without sending a single formula.

2MNY Admin • Oct 13, 2026 • 4 min read

Put the reading to work

Run a free scan and see which of the issues we write about are live on your website right now.

Start Free Scan