A CSV Injection vulnerability exists in iDempiere WebUI
v12.0.0.202508171158. The application fails to properly sanitize
user-supplied input before including it in exported CSV files. An
authenticated attacker can inject malicious spreadsheet formulas
(e.g., =cmd|'/C
notepad'!A1) into fields that are later exported. When the CSV is opened in
spreadsheet software such as Microsoft Excel or LibreOffice Calc, the
injected formula is executed. Successful exploitation may allow arbitrary
command execution on the victim’s workstation, data exfiltration via
external cell references, or manipulation of the exported spreadsheet
content.

*Request:*

POST /webui HTTP/2

Host: <host>

-

dtid=******&cmd_0=onInitEdit&data_0=%7B%22value%22%3A%22%3Dcmd%7C'%20%2FC%20notepad'!'A1'%22%7D&cmd_1=onBlur
--snip--



*Response:*

HTTP/2 200 OK

-


{"rs"--snip--: =cmd|\' /C
notepad\'!\'A1\'',iconSclass:'z-icon-Window'},{},[]],