Is CVE-2020-36962 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-36962 being exploited in the wild.

How severe is CVE-2020-36962?

Critical severity, with a CVSS score of 9.8, published 28 January 2026.

Which products and versions are affected?

tendenci (PyPI) < 12.3.2, ECOSYSTEM:introduced=0,fixed=12.3.2, ECOSYSTEM:introduced=0,last_affected=12.3.1.

Is there a fix for CVE-2020-36962?

Yes. tendenci (PyPI): upgrade to 12.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-36962 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2020-36962?

Check whether you run tendenci (PyPI) or Tendenci at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-36962: Tendenci CSV formula injection in contact form message field

Q: Which products and versions are affected?

tendenci (PyPI) < 12.3.2, ECOSYSTEM:introduced=0,fixed=12.3.2, ECOSYSTEM:introduced=0,last_affected=12.3.1.

Q: Is there a fix for CVE-2020-36962?

Yes. tendenci (PyPI): upgrade to 12.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2020-36962 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2020-36962?

Check whether you run tendenci (PyPI) or Tendenci at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-36962 · Severity: critical · CVSS 9.8 · Published 2026-01-28

Tendenci is an open-source platform used by non-profits and associations to manage memberships, events, and communications. A vulnerability in the platform's contact form allows attackers to submit messages containing malicious spreadsheet formulas. If an administrator exports these messages to a CSV file and opens it in a program like Microsoft Excel, the attacker could gain control over the administrator's computer, potentially leading to data theft or unauthorized system access.

Technologies: tendenci (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2020-36962 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-36962 being exploited in the wild.
How severe is CVE-2020-36962?: Critical severity, with a CVSS score of 9.8, published 28 January 2026.
Which products and versions are affected?: tendenci (PyPI) < 12.3.2, ECOSYSTEM:introduced=0,fixed=12.3.2, ECOSYSTEM:introduced=0,last_affected=12.3.1.
Is there a fix for CVE-2020-36962?: Yes. tendenci (PyPI): upgrade to 12.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-36962 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2020-36962?: Check whether you run tendenci (PyPI) or Tendenci at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tendenci (PyPI): upgrade to 12.3.2 or later
```
pip install "tendenci>=12.3.2"
```

Technical details

A CSV injection (CWE-1236) vulnerability exists in Tendenci versions prior to 12.3.2. The root cause is the improper neutralization of formula-related characters (such as =, +, -, or @) in the 'message' field of the Contact Us form. An unauthenticated remote attacker can submit a crafted payload, such as '=cmd|' /C calc'!A0', which is stored in the database. When a privileged user exports these form entries into a CSV file and opens it in a spreadsheet application (e.g., Excel, LibreOffice), the application may interpret the payload as a command, leading to arbitrary code execution on the user's workstation. This has been patched in version 12.3.2.

Affected products

Tendenci Tendenci < 12.3.2

Identifiers

CVE-2020-36962
GHSA-4q3w-jgfx-4792
PYSEC-2026-136

Timeline

2020-10-29: disclosed: Vulnerability discovered by researcher
2020-12-01: other: Exploit published on Exploit-DB
2026-01-28: advisory: GitHub Advisory and NVD publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.