CSV Injection in Symfony
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Symfony versions 4.1.0 before 4.4.35 and versions 5.0.0 before 5.3.12 are vulnerable to CSV injection, also known as formula injection. In Symfony 4.1, maintainers added the opt-in `csv_escape_formulas` option in the `CsvEncoder`, to prefix all cells starting with `=`, `+`, `-` or `@` with a tab `\t`. Since then, OWASP added 2 chars in that list: Tab (0x09) and Carriage return (0x0D). This makes the previous prefix char (Tab `\t`) part of the vulnerable characters, and OWASP suggests using the single quote `'` for prefixing the value. Starting with versions 4.4.34 and 5.3.12, Symfony now follows the OWASP recommendations and uses the single quote `'` to prefix formulas and add the prefix to cells starting by `\t`, `\r` as well as `=`, `+`, `-` and `@`.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| symfony | symfony | 4.1.0 to before 4.4.35; 5.0.0 to before 5.3.12 | 4.4.35, 5.3.12 | Patch available | CNA |
| — | symfony/serializer (Packagist) | 5.0.0 to before 5.3.12 | 5.3.12 | Patch available | GHSA-2xhg-w2g5-w95x |
| — | symfony/serializer (Packagist) | 4.1.0 to before 4.4.35 | 4.4.35 | Patch available | GHSA-2xhg-w2g5-w95x |
| — | symfony/symfony (Packagist) | 4.1.0 to before 4.4.35 | 4.4.35 | Patch available | GHSA-2xhg-w2g5-w95x |
| — | symfony/symfony (Packagist) | 5.0.0 to before 5.3.12 | 5.3.12 | Patch available | GHSA-2xhg-w2g5-w95x |
- symfony Vendorsymfony Affected 4.1.0 to before 4.4.35; 5.0.0 to before 5.3.12 Fixed in 4.4.35, 5.3.12 Patch available CNA
- symfony/serializer (Packagist) Vendor— Affected 5.0.0 to before 5.3.12 Fixed in 5.3.12 Patch available GHSA-2xhg-w2g5-w95x
- symfony/serializer (Packagist) Vendor— Affected 4.1.0 to before 4.4.35 Fixed in 4.4.35 Patch available GHSA-2xhg-w2g5-w95x
- symfony/symfony (Packagist) Vendor— Affected 4.1.0 to before 4.4.35 Fixed in 4.4.35 Patch available GHSA-2xhg-w2g5-w95x
- symfony/symfony (Packagist) Vendor— Affected 5.0.0 to before 5.3.12 Fixed in 5.3.12 Patch available GHSA-2xhg-w2g5-w95x
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* | 4.1.0 to before 4.4.35; 5.0.0 to before 5.3.12 | Vulnerable | sensiolabs |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
- cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* Versions 4.1.0 to before 4.4.35; 5.0.0 to before 5.3.12 Vulnerable ·sensiolabs
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA symfony (symfony) Fixed in 4.4.35, 5.3.12
- Fix · GHSA-2xhg-w2g5-w95x symfony/serializer (Packagist) Fixed in 5.3.12 Advisory →
- Fix · GHSA-2xhg-w2g5-w95x symfony/serializer (Packagist) Fixed in 4.4.35 Advisory →
- Fix · GHSA-2xhg-w2g5-w95x symfony/symfony (Packagist) Fixed in 4.4.35 Advisory →
- Fix · GHSA-2xhg-w2g5-w95x symfony/symfony (Packagist) Fixed in 5.3.12 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-41270
- 2026-10-03 Alias added: GHSA-2xhg-w2g5-w95x
References
Patch 3
Advisory 4
Other 8
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/serializer/CVE-2021-41270.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2021-41270.yaml
- https://github.com/symfony/symfony
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BPT4SF6SIXFMZARDWED5T32J7JEH3EP
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QSREFD2TJT5LWKM6S4MD3W26NQQ5WJUP
- https://lists.fedoraproject.org/archives/list/[email protected]/message/3BPT4SF6SIXFMZARDWED5T32J7JEH3EP
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QSREFD2TJT5LWKM6S4MD3W26NQQ5WJUP
- https://symfony.com/cve-2021-41270
More symfony vulnerabilities
- TI-2024-33775 Ability to change environment from query in symfony/runtime CVSS 3.1HIGH 7.3
- TI-2026-34283 Twig: The `spaceless` filter implicitly marks its output as safe CVSS 4.0MEDIUM 5.1
- TI-2022-07667 Code injection in Twig CVSS 3.1CRITICAL 9.8
- TI-2018-10028 Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key… CVSS 3.0CRITICAL 9.8
- TI-2026-35851 Incorrect authorization in symfony CVSS 4.0HIGH 8.7
- TI-2026-35264 Improper input validation in symfony CVSS 4.0HIGH 8.3
Sources
- CVE-2021-41270 · CVE Program
- CVE-2021-41270 · NVD
- FIRST EPSS
- GHSA-2xhg-w2g5-w95x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences