MRBS · CVE-2026-129133 · Other
NO FIX YET · SEE WHAT TO DO
MRBS before 1.13.0 does not neutralize leading formula characters in CSV report exports, so booking data an authenticated user stores can become spreadsheet formulas. When a privileged user opens an exported report, those formulas can exfiltrate data or run commands via DDE.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
MRBS installations before 1.13.0 that let authenticated users enter booking names, descriptions or custom fields, and whose privileged staff export CSV reports and open them in spreadsheet software. Installations with no untrusted authenticated users or that do not use CSV report export are lower risk. The sources do not describe further conditions.
Not affected if no-csv-export, version-1.13.0-or-later
Who cares mrbs, self-hosted, spreadsheet-export
1.13.0escape() function in web/report.php and whether it handles leading =, +, - and @ charactersMRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape() function in web/report.php fails to neutralize leading formula characters. Attackers can store formulas in booking names, descriptions or custom fields that execute when privileged users open exported CSV reports, enabling data exfiltration or command execution via DDE.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
1.13.0 or laterThis page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.