Read the docs
TI-2020-19097 Aliases CVE-2020-36962GHSA-4q3w-jgfx-4792

Tendenci 12.3.1 - CSV/ Formula Injection

Priority MEDIUM 63CWE-1236Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads like '=10+20+cmd|' /C calc'!A0' in the message field to trigger arbitrary command execution when the CSV is opened in spreadsheet applications.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.12363 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed tendenci (PyPI): 12.3.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TendenciTendenci12.3.1—No fix listedCNA
—tendenci (PyPI)before 12.3.212.3.2Patch availableGHSA-4q3w-jgfx-4792
  • Tendenci VendorTendenci Affected 12.3.1 Fixed in — No fix listed CNA
  • tendenci (PyPI) Vendor— Affected before 12.3.2 Fixed in 12.3.2 Patch available GHSA-4q3w-jgfx-4792

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tendenci:tendenci:12.3.1:*:*:*:*:*:*:*12.3.1VulnerableTendenci
  • cpe:2.3:a:tendenci:tendenci:12.3.1:*:*:*:*:*:*:* Versions 12.3.1 Vulnerable ·Tendenci

Remediation

  • Fix · GHSA-4q3w-jgfx-4792 tendenci (PyPI) Fixed in 12.3.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-36962
  2. 2026-10-03 Alias added: GHSA-4q3w-jgfx-4792

References

Exploit 1

Advisory 1

Other 5

  • TI-2025-43174 A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS… CVSS 3.1MEDIUM 5.4
  • TI-2025-43173 A stored cross-site scripting (XSS) vulnerability in the Jobs module of Tendenci CMS… CVSS 3.1MEDIUM 5.4
  • TI-2020-11752 Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py. CVSS 3.1CRITICAL 9.8
  • TI-2026-19288 Tendenci has Authenticated Remote Code Execution via Pickle Deserialization CVSS 3.1MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences