CVE-2019-12134
Description
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in Workday through 32 via a value (provided by a low-privileged user in a contact form field) that is mishandled in a CSV export.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Workday/Workdaydescription
Patches
Vulnerability mechanics
Root cause
"Missing output sanitization in CSV export allows formula-injection characters (e.g., `=`) to be interpreted as spreadsheet formulas."
Attack vector
A low-privileged attacker inserts a formula (e.g., starting with `=`) into any contact form field. When an administrator or HR user exports that data as a CSV or Excel file and opens it, the formula is executed by the spreadsheet application. This can lead to remote code execution on the client via Dynamic Data Exchange (DDE) or data leakage through malicious hyperlinks [ref_id=1].
Affected code
The export feature in Workday through version 32 mishandles contact form field values when generating CSV output. The advisory does not specify exact file paths or function names, but the vulnerable code path is the CSV/Excel export routine that processes user-supplied contact form data [ref_id=1].
What the fix does
No patch is published in the bundle. The advisory recommends that the application escape fields starting with `=` (and other formula-triggering characters such as `+`, `-`, `@`) when exporting data to CSV or Excel formats, preventing the spreadsheet application from interpreting them as formulas [ref_id=1].
Preconditions
- inputAttacker must be able to submit data into a contact form field that is later exported by an administrator
- configAdministrator or HR user must export the data as CSV/Excel and open the file in a spreadsheet application that supports formula execution (e.g., Excel)
Reproduction
Insert an Excel formula such as `=rundll32|'URL.dll,OpenURL calc.exe'!A` into any contact form field. When an administrator exports the data as CSV/Excel and opens the file, the formula will be calculated, potentially executing arbitrary commands [ref_id=1].
Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1- sinfosec757.blogspot.com/2019/06/exploit-title-workday-32-csv-injection.htmlmitrex_refsource_MISC
News mentions
0No linked articles in our index yet.