{"id":"CVE-2022-2112","aliases":["GHSA-9hx5-jmxv-x44q","PYSEC-2026-824"],"title":"CSV Injection in inventree","summary":"CSV Injection in inventree","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendor":"inventree","product":"inventree","ecosystem":"pip","affected":["inventree < 0.7.2"],"patched":["inventree 0.7.2"],"published":"2022-06-18","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-9hx5-jmxv-x44q","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2112"},{"url":"https://github.com/inventree/inventree/commit/26bf51c20a1c9b3130ac5dd2e17649bece5ff84f"},{"url":"https://github.com/inventree/InvenTree"},{"url":"https://huntr.dev/bounties/e57c36e7-fa39-435f-944a-3a52ee066f73"}],"tags":["osv","pip"],"epss":0.01283,"epssPercentile":0.68308,"ingestedAt":"2026-07-08T18:25:48.025Z","slug":"CVE-2022-2112","body":"## Overview\n\nImproper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.\n\n## Affected packages\n\n- `inventree < 0.7.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `inventree 0.7.2`","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}