Critical severity9.1NVD Advisory· Published Oct 6, 2021· Updated Jun 17, 2026
CVE-2021-41128
CVE-2021-41128
Description
Hygeia is an application for collecting and processing personal and case data in connection with communicable diseases. In affected versions all CSV Exports (Statistics & BAG MED) contain a CSV Injection Vulnerability. Users of the system are able to submit formula as exported fields which then get executed upon ingestion of the exported file. There is no validation or sanitization of these formula fields and so malicious may construct malicious code. This vulnerability has been resolved in version 1.30.4. There are no workarounds and all users are advised to upgrade their package.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- jshmrtn/hygeiav5Range: > 1.11.0, < 1.30.4
Patches
Vulnerability mechanics
References
5- github.com/jshmrtn/hygeia/commit/d917f27432fe84e1c9751222ae55bae36a4dce60nvdPatchThird Party Advisory
- github.com/jshmrtn/hygeia/security/advisories/GHSA-8pwv-jhj2-2369nvdPatchThird Party Advisory
- github.com/beatrichartz/csv/issues/103nvdIssue TrackingThird Party Advisory
- github.com/beatrichartz/csv/pull/104nvdThird Party Advisory
- owasp.org/www-community/attacks/CSV_InjectionnvdThird Party Advisory
News mentions
0No linked articles in our index yet.