Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Medium severity, with a CVSS score of 5.2, published 4 June 2026.
- Which products and versions are affected?
- Spree spree >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.6; >= 5.4.0, < 5.4.3.
- Is there a fix for This vulnerability?
- A patch was published on 2026-06-04. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network, in a software library.
- Am I affected?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A CSV/Formula Injection vulnerability (CWE-1236) exists in Spree's `CustomerPresenter`. The application fails to neutralize formula-related characters (such as '=', '+', '-', or '@') in user-controlled fields like `first_name`, `last_name`, and address details before writing them to a CSV export file. An attacker can register as a customer and provide a malicious payload (e.g., `=HYPERLINK` or `=DDE`) in these fields. When an administrator generates and opens the customer export in a spreadsheet application like Excel or LibreOffice, the formula executes. This can be used to exfiltrate adjacent cell data (PII, order history) to an attacker-controlled server or execute OS commands via Dynamic Data Exchange (DDE) on vulnerable systems. Patches are available in versions 5.2.8, 5.3.6, and 5.4.3.
Affected products
- Spree spree >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.6; >= 5.4.0, < 5.4.3
Timeline
- 2026-05-19: disclosed
- 2026-06-04: advisory
- 2026-06-04: patched