# CVE-2017-15879: KeystoneJS CSV injection in export

Source: https://junglewise.ai/threats/cve-2017-15879-keystonejs-csv-injection-in-export  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-11-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2017-15879 · Severity: low · CVSS 3 · Published 2017-11-16

KeystoneJS is a Node.js web application framework that includes admin interfaces and data management features. An attacker can inject malicious formulas into CSV export files that, when opened in spreadsheet applications like Excel, execute arbitrary code on a user's computer—a technique known as CSV injection or formula injection.

Technologies: [keystone (npm)](https://junglewise.ai/threats/technologies/npm-keystone). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2017-15879 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-15879 being exploited in the wild.

**How severe is CVE-2017-15879?** Low severity, with a CVSS score of 3, published 16 November 2017.

**Which products and versions are affected?** keystone (npm) SEMVER:introduced=0,fixed=4.0.0-beta7.

**Is there a fix for CVE-2017-15879?** Yes. keystone (npm): upgrade to 4.0.0-beta7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-15879 attacked?** It is attacked over the network.

**Am I affected by CVE-2017-15879?** Check whether you run keystone (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- keystone (npm): upgrade to 4.0.0-beta7 or later

  ```sh
  npm install keystone@4.0.0-beta7
  ```


## Technical details

CSV Injection (CWE-20: Improper Input Validation) exists in the CSV export functionality of KeystoneJS versions prior to 4.0.0-beta.7, specifically in admin/server/api/download.js and lib/list/getCSVData.js. When a user exports data to CSV format, untrusted values in database fields are not sanitized before being written to the CSV file. An attacker can store a formula-like string (e.g., "=cmd|'/c calc'!A1") in a database field; when an administrator exports the data and opens it in Excel or similar software, the formula is executed. The attack requires user interaction (opening the CSV file in a spreadsheet application) but no authentication. Fixed in version 4.0.0-beta.7 and later.

## Affected products

- KeystoneJS Keystone before 4.0.0-beta.7

## Identifiers

- CVE-2017-15879
- GHSA-6494-v9fq-fgq2

## Timeline

- 2017-11-16: disclosed
- 2017-12-02: patched: Fixed in version 4.0.0-beta.7

## References

- [https://github.com/keystonejs/keystone/pull/4478](https://github.com/keystonejs/keystone/pull/4478)

## Related threats

- [Keystone cross-site scripting](https://junglewise.ai/threats/keystone-cross-site-scripting-9990301e)
- [KeystoneJS keystone authentication weakness in email matching](https://junglewise.ai/threats/keystonejs-keystone-authentication-weakness-in-email-matching-6ecf46db)
- [Keystone Cross-Site Request Forgery (CSRF)](https://junglewise.ai/threats/cve-2017-16570-keystone-cross-site-request-forgery-csrf)
- [KeystoneJS cross-site scripting in blog posts](https://junglewise.ai/threats/cve-2017-15881-keystonejs-cross-site-scripting-in-blog-posts)
- [KeystoneJS Cross-Site Scripting in contact form](https://junglewise.ai/threats/cve-2017-15878-keystonejs-cross-site-scripting-in-contact-form)