---
id: "CVE-2026-129133"
page: "https://infrastack.ai/live/CVE-2026-129133"
kind: "vulnerability"
aliases: ["CVE-2026-129133"]
title: "MRBS: CSV exports let stored spreadsheet formulas run when opened"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "MRBS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["mrbs", "other", "self-hosted", "spreadsheet-export"]
not_affected_if: ["no-csv-export", "version-1.13.0-or-later"]
published_at: "2026-11-13T17:17:31+00:00"
first_seen_at: "2026-11-13T17:48:01+00:00"
updated_at: "2026-11-13T17:49:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129133", "first_seen_at": "2026-11-13T17:48:01+00:00"}]
exploit_sources: []
---

# MRBS: CSV exports let stored spreadsheet formulas run when opened

Link for people: https://infrastack.ai/live/CVE-2026-129133 (this .md is for agents)

MRBS before 1.13.0 does not neutralize leading formula characters in CSV report exports, so booking data an authenticated user stores can become spreadsheet formulas. When a privileged user opens an exported report, those formulas can exfiltrate data or run commands via DDE.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MRBS affected range not listed fixed no fixed version listed

## How to check

- Check the installed MRBS version and confirm whether it is below `1.13.0`
- Look for the `escape()` function in `web/report.php` and whether it handles leading `=`, `+`, `-` and `@` characters

## Fix

- Upgrade MRBS to `1.13.0` or later

## Timeline

- 2026-11-13T17:48:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129133

## Documents

- [advisory] Vendor advisory: github.com https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-9rvp-v4ff-wpwr
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/mrbs-before-1.13.0-csv-formula-injection-via-report-export
- [fix] Patch: github.com https://github.com/meeting-room-booking-system/mrbs-code/commit/92f6f5610072ddb9e1b38074c410fc8be56947ed
- [fix] Release notes: github.com https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.13.0

## From the sources

MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape() function in web/report.php fails to neutralize leading formula characters. Attackers can store formulas in booking names, descriptions or custom fields that execute when privileged users open exported CSV reports, enabling data exfiltration or command execution via DDE.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_