{"id":"CVE-2026-129133","kind":"vulnerability","aliases":["CVE-2026-129133"],"related":[],"title":"MRBS: CSV exports let stored spreadsheet formulas run when opened","description":"MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape() function in web/report.php fails to neutralize leading formula characters. Attackers can store formulas in booking names, descriptions or custom fields that execute when privileged users open exported CSV reports, enabling data exfiltration or command execution via DDE.","summary":"MRBS before 1.13.0 does not neutralize leading formula characters in CSV report exports, so booking data an authenticated user stores can become spreadsheet formulas. When a privileged user opens an exported report, those formulas can exfiltrate data or run commands via DDE.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MRBS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["mrbs","other","self-hosted","spreadsheet-export"],"not_affected_if":["no-csv-export","version-1.13.0-or-later"],"how_to_check":"- Check the installed MRBS version and confirm whether it is below `1.13.0`\n- Look for the `escape()` function in `web/report.php` and whether it handles leading `=`, `+`, `-` and `@` characters","fix":"- Upgrade MRBS to `1.13.0` or later","status":"open","published_at":"2026-11-13T17:17:31+00:00","first_seen_at":"2026-11-13T17:48:01+00:00","triaged_at":"2026-11-13T17:49:06+00:00","updated_at":"2026-11-13T17:49:06+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T17:49:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MRBS to `1.13.0` or later","reach":"network","title":"MRBS: CSV exports let stored spreadsheet formulas run when opened","impact":"medium","summary":"MRBS before 1.13.0 does not neutralize leading formula characters in CSV report exports, so booking data an authenticated user stores can become spreadsheet formulas. When a privileged user opens an exported report, those formulas can exfiltrate data or run commands via DDE.","audience":"businesses","category":"other","nicknames":[],"who_cares":["mrbs","self-hosted","spreadsheet-export"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Formulas in exported reports run commands or exfiltrate data on staff machines","analyst_note":"","how_to_check":"- Check the installed MRBS version and confirm whether it is below `1.13.0`\n- Look for the `escape()` function in `web/report.php` and whether it handles leading `=`, `+`, `-` and `@` characters\n- unknown","plain_action":"","product_name":"MRBS","needs_analyst":false,"not_affected_if":["version-1.13.0-or-later","no-csv-export"],"who_is_affected":"MRBS installations before 1.13.0 that let authenticated users enter booking names, descriptions or custom fields, and whose privileged staff export CSV reports and open them in spreadsheet software. Installations with no untrusted authenticated users or that do not use CSV report export are lower risk. The sources do not describe further conditions.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00076,"input_tokens":4652,"output_tokens":589,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129133':13A,16A '-2026':12A,15A '1.13.0':28B,70C 'allow':78C 'attack':97C 'authent':43B,79C 'becom':47B 'book':40B,102C 'charact':34B,96C 'command':65B,121C 'contain':71C 'csv':2A,36B,73C,115C 'custom':106C 'cve':11A,14A 'data':41B,62B,118C 'dde':67B,124C 'descript':104C 'enabl':117C 'escap':87C 'execut':109C,122C 'exfiltr':61B,119C 'export':3A,25B,38B,56B,114C 'fail':91C 'field':107C 'formula':7A,33B,49B,59B,74C,84C,95C,100C 'function':88C 'host':22B 'inject':75C,82C 'lead':32B,94C 'let':4A 'mrbs':1A,17A,18B,26B,68C 'name':103C 'neutral':31B,93C 'open':10A,54B,113C 'privileg':52B,111C 'report':37B,57B,116C 'run':8A,64B 'self':21B 'self-host':20B 'spreadsheet':6A,24B,48B,83C 'spreadsheet-export':23B 'store':5A,45B,99C 'user':44B,53B,80C,112C 'via':66B,123C 'vulner':76C 'web/report.php':90C","nicknames":[],"mitigations":[],"who_affected":"MRBS installations before 1.13.0 that let authenticated users enter booking names, descriptions or custom fields, and whose privileged staff export CSV reports and open them in spreadsheet software. Installations with no untrusted authenticated users or that do not use CSV report export are lower risk. The sources do not describe further conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mrbs"],"ptokens":["mrbs"],"labels":["medium","mrbs","other","selfhosted","spreadsheetexport","vendor"],"campaign_type":null,"search_a":"'-129133':13A,16A '-2026':12A,15A 'csv':2A 'cve':11A,14A 'export':3A 'formula':7A 'let':4A 'mrbs':1A,17A 'open':10A 'run':8A 'spreadsheet':6A 'store':5A","search_b":"'1.13.0':28B 'authent':43B 'becom':47B 'book':40B 'charact':34B 'command':65B 'csv':36B 'data':41B,62B 'dde':67B 'exfiltr':61B 'export':25B,38B,56B 'formula':33B,49B,59B 'host':22B 'lead':32B 'mrbs':18B,26B 'neutral':31B 'open':54B 'privileg':52B 'report':37B,57B 'run':64B 'self':21B 'self-host':20B 'spreadsheet':24B,48B 'spreadsheet-export':23B 'store':45B 'user':44B,53B 'via':66B","search_c":"'1.13.0':70C 'allow':78C 'attack':97C 'authent':79C 'book':102C 'charact':96C 'command':121C 'contain':71C 'csv':73C,115C 'custom':106C 'data':118C 'dde':124C 'descript':104C 'enabl':117C 'escap':87C 'execut':109C,122C 'exfiltr':119C 'export':114C 'fail':91C 'field':107C 'formula':74C,84C,95C,100C 'function':88C 'inject':75C,82C 'lead':94C 'mrbs':68C 'name':103C 'neutral':93C 'open':113C 'privileg':111C 'report':116C 'spreadsheet':83C 'store':99C 'user':80C,112C 'via':123C 'vulner':76C 'web/report.php':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T19:06:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129133","severity":null,"published_at":"2026-11-13T17:17:31+00:00","modified_at":"2026-11-13T17:17:31+00:00","first_seen_at":"2026-11-13T17:48:01+00:00","fetched_at":"2026-11-13T17:48:01+00:00","note":null}],"documents":[{"id":148137,"url":"https://github.com/meeting-room-booking-system/mrbs-code/commit/92f6f5610072ddb9e1b38074c410fc8be56947ed","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148138,"url":"https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.13.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":148143,"url":"https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-9rvp-v4ff-wpwr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-12T19:06:46+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":148144,"url":"https://www.vulncheck.com/advisories/mrbs-before-1.13.0-csv-formula-injection-via-report-export","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}