Vulnerability · Published Jan 28, 2026 · Assigned by VulnCheck

CVE-2020-36962Tendenci 12.3.1 - CSV/ Formula Injection

Critical 9.8

In plain English

A critical-severity security flaw in Tendenci from Tendenci. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 12.5% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)12.5%top 3.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads like '=10+20+cmd|' /C calc'!A0' in the message field to trigger arbitrary command execution when the CSV is opened in spreadsheet applications.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	tendenci	12.3.2	GHSA-4q3w-jgfx-4792
PyPI	tendenci	no fix listed	PYSEC-2026-136

Affected products (as reported)

Vendor	Product	Versions
Tendenci	Tendenci	12.3.1

Weakness: CWE-1236 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

ExploitDB-49145 exploit
Official Vendor Homepage product
Tendenci GitHub Repository product
VulnCheck Advisory: Tendenci 12.3.1 - CSV/ Formula Injection third-party-advisory