CVE-2026-129133 in mrbs-code
Summary
by MITRE • 11/13/2026
MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape() function in web/report.php fails to neutralize leading formula characters. Attackers can store formulas in booking names, descriptions or custom fields that execute when privileged users open exported CSV reports, enabling data exfiltration or command execution via DDE.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2026
The vulnerability identified in MRBS versions prior to 1.13.0 represents a significant security risk classified as CSV formula injection, which falls under the broader category of CWE-74 Improper Neutralization of Special Elements used in an Export Function within Data Processing Applications. This flaw arises from insufficient input validation and sanitization mechanisms specifically located in the web/report.php module. The core technical deficiency lies in the failure of the escape() function to properly neutralize leading characters that are interpreted as formula initiators by spreadsheet applications such as Microsoft Excel or LibreOffice Calc. When users with authenticated access create bookings, they can intentionally craft booking names, descriptions, or custom field values containing malicious strings prefixed with symbols like equals signs, plus signs, minus signs, tabs, or at signs. These prefixes serve as triggers for spreadsheet software to interpret the cell content not as plain text but as executable code.
The operational impact of this vulnerability is severe because it leverages social engineering tactics combined with technical exploitation vectors. An attacker does not need administrative privileges to exploit this flaw; merely having authenticated access to create or modify bookings is sufficient. Once a malicious booking containing an injected formula is created, the threat materializes when privileged users generate and open CSV reports exported from the system. Upon opening these files in spreadsheet applications, the embedded formulas execute automatically. This execution can lead to data exfiltration where sensitive information stored within the application or accessible by the user's environment is sent to a remote server controlled by the attacker. Furthermore, through Dynamic Data Exchange mechanisms, specifically DDE commands, an attacker may achieve arbitrary command execution on the victim's machine if the spreadsheet software permits such interactions and security settings are not strictly configured to block them.
This attack vector aligns with MITRE ATT&CK techniques related to Initial Access via Spearphishing Attachment or Stored XSS-like behaviors where malicious content is persisted in a trusted location for later exploitation. The persistence of the payload within booking metadata ensures that every time an administrator reviews reports, they are potentially exposed to the exploit without their knowledge. To mitigate this risk, organizations running MRBS must immediately upgrade to version 1.13.0 or later, where these sanitization issues have been addressed by developers who implemented stricter encoding and escaping rules for special characters in export functions. In addition to upgrading, administrators should enforce strict input validation policies that reject any booking entries containing potential formula prefixes. It is also advisable to configure spreadsheet applications used within the organization to disable DDE macros and auto-execution of formulas from external sources, thereby adding a layer of defense-in-depth against this specific type of data processing vulnerability.