# CVE-2020-36962: Tendenci CSV formula injection in contact form message field

Source: https://junglewise.ai/threats/cve-2020-36962-tendenci-csv-formula-injection-in-contact-form-message-field  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-28. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2020-36962 · Severity: critical · CVSS 9.8 · Published 2026-01-28

Tendenci is an open-source platform used by non-profits and associations to manage memberships, events, and communications. A vulnerability in the platform's contact form allows attackers to submit messages containing malicious spreadsheet formulas. If an administrator exports these messages to a CSV file and opens it in a program like Microsoft Excel, the attacker could gain control over the administrator's computer, potentially leading to data theft or unauthorized system access.

Technologies: [tendenci (PyPI)](https://junglewise.ai/threats/technologies/tendenci). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2020-36962 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-36962 being exploited in the wild.

**How severe is CVE-2020-36962?** Critical severity, with a CVSS score of 9.8, published 28 January 2026.

**Which products and versions are affected?** tendenci (PyPI) < 12.3.2, ECOSYSTEM:introduced=0,fixed=12.3.2, ECOSYSTEM:introduced=0,last_affected=12.3.1.

**Is there a fix for CVE-2020-36962?** Yes. tendenci (PyPI): upgrade to 12.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-36962 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2020-36962?** Check whether you run tendenci (PyPI) or Tendenci at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tendenci (PyPI): upgrade to 12.3.2 or later

  ```sh
  pip install "tendenci>=12.3.2"
  ```


## Technical details

A CSV injection (CWE-1236) vulnerability exists in Tendenci versions prior to 12.3.2. The root cause is the improper neutralization of formula-related characters (such as =, +, -, or @) in the 'message' field of the Contact Us form. An unauthenticated remote attacker can submit a crafted payload, such as '=cmd|' /C calc'!A0', which is stored in the database. When a privileged user exports these form entries into a CSV file and opens it in a spreadsheet application (e.g., Excel, LibreOffice), the application may interpret the payload as a command, leading to arbitrary code execution on the user's workstation. This has been patched in version 12.3.2.

## Affected products

- Tendenci Tendenci < 12.3.2

## Identifiers

- CVE-2020-36962
- GHSA-4q3w-jgfx-4792
- PYSEC-2026-136

## Timeline

- 2020-10-29: disclosed: Vulnerability discovered by researcher
- 2020-12-01: other: Exploit published on Exploit-DB
- 2026-01-28: advisory: GitHub Advisory and NVD publication

## References

- [https://github.com/tendenci/tendenci](https://github.com/tendenci/tendenci)
- [https://www.exploit-db.com/exploits/49145](https://www.exploit-db.com/exploits/49145)
- [https://www.tendenci.com/](https://www.tendenci.com/)
- [https://www.vulncheck.com/advisories/tendenci-csv-formula-injection](https://www.vulncheck.com/advisories/tendenci-csv-formula-injection)
- [https://github.com/tendenci/tendenci/commit/3e37622cac81440c5a1f97c39f112a2cf4a5450c](https://github.com/tendenci/tendenci/commit/3e37622cac81440c5a1f97c39f112a2cf4a5450c)

## Related threats

- [PYSEC-2026-1950 - Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization](https://junglewise.ai/threats/cve-2026-23946-tendenci-helpdesk-authenticated-remote-code-execution-via-pickle)
- [Tendenci CMS stored XSS in Jobs and Forums modules](https://junglewise.ai/threats/cve-2025-70959-tendenci-cms-stored-xss-in-jobs-and-forums-modules)
- [Tendenci CMS stored XSS in Forums and Jobs modules](https://junglewise.ai/threats/cve-2025-70960-tendenci-cms-stored-xss-in-forums-and-jobs-modules)
- [PYSEC-2020-112 - Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.](https://junglewise.ai/threats/cve-2020-14942-deserialization-of-untrusted-data-in-tendenci)