VNX-1236: Improper Neutralization of Formula Elements in a CSV File

Field	Value
Rule ID	VNX-1236
Severity	Medium
SARIF level	warning
Kind	sast
Languages	Java, JavaScript / TypeScript, Python
CWE	CWE-1236
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	csv-injection cwe-1236
Source	internal/sast/rules/vnx-1236.rego

Overview

VNX-1236 maps to CWE-1236: Improper Neutralization of Formula Elements in a CSV File. Reports a CSV export served to users (the file sets a text/csv content type, a .csv attachment or download name) that writes data rows through a CSV library without neutralising cells beginning with =, +, -, @, tab or carriage return, so a stored value such as =HYPERLINK(…) or =cmd|… runs as a formula when the download is opened in a spreadsheet. Reported: Python csv.writer/csv.DictWriter .writerow()/.writerows() and pandas .to_csv(); JavaScript json2csv (new Parser().parse, json2csv.parse), csv-stringify stringify(), fast-csv write/format, and papaparse Papa.unparse() without escapeFormulae; Java OpenCSV CSVWriter.writeNext()/writeAll() and Apache Commons CSV CSVPrinter.printRecord()/printRecords(). Not reported: header rows made only of string literals, files that neutralise formula cells (a sanitise/escape-formula helper, a check against the formula characters, defusedcsv, escapeFormulae: true), CSV written to local files with no HTTP download context, comments and test files. The download context and the neutralisation are judged on code with comment lines removed, so a Javadoc mentioning text/csv is not a download and a TODO saying sanitise is not a sanitiser. Building CSV lines by string concatenation from request data is VNX-140’s finding.

Why This Matters

This weakness class (Improper Neutralization of Formula Elements in a CSV File) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-1236 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.

What Gets Flagged

response = HttpResponse(content_type="text/csv")
writer = csv.writer(response)
writer.writerow(["Name", "Email"])              # header literals: not flagged
for c in Customer.objects.all():
    writer.writerow([c.name, c.email, c.notes])  # FLAGGED

// Node: res.attachment('users.csv')
const csv = new Parser({ fields }).parse(users)  // FLAGGED
res.send(Papa.unparse(data, { escapeFormulae: true }))  // not flagged

Remediation

1. Review each flagged line and determine whether the pattern represents a real instance of CWE-1236 or a false positive.
2. Replace the flagged construct with a documented safe alternative appropriate to your language and framework.
3. For confirmed false positives, add a # vulnetix-ignore: VNX-1236 comment on the line.
4. Ensure equivalent test coverage exists to prevent regression.

References

• CWE-1236: Improper Neutralization of Formula Elements in a CSV File
• OWASP Top 10

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1236
// nosec vnx-1236

Or record an ignore rule: vulnetix ignore add --rule vnx-1236 --reason "...". See Suppressing findings.