Executive brief
Spree is an open-source e-commerce platform. A vulnerability in its customer export feature allows attackers to inject malicious spreadsheet formulas into their user profile data. When a store administrator exports customer data and opens the resulting CSV file in software like Microsoft Excel, these formulas can execute, potentially leading to the theft of sensitive customer information or the execution of unauthorized commands on the administrator's computer.
Technical details
A CSV/Formula Injection vulnerability (CWE-1236) exists in Spree's `CustomerPresenter`. The application fails to neutralize formula-related characters (such as '=', '+', '-', or '@') in user-controlled fields like `first_name`, `last_name`, and address details before writing them to a CSV export file. An attacker can register as a customer and provide a malicious payload (e.g., `=HYPERLINK` or `=DDE`) in these fields. When an administrator generates and opens the customer export in a spreadsheet application like Excel or LibreOffice, the formula executes. This can be used to exfiltrate adjacent cell data (PII, order history) to an attacker-controlled server or execute OS commands via Dynamic Data Exchange (DDE) on vulnerable systems. Patches are available in versions 5.2.8, 5.3.6, and 5.4.3.
Affected products
- Spree spree >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.6; >= 5.4.0, < 5.4.3
Timeline
- 2026-05-19: disclosed
- 2026-06-04: advisory
- 2026-06-04: patched