CVE-2026-5242: Pizzy Library Code Injection via CSV Formula Injection (CVSS 8.8)

Technical summary

CVE-2026-5242 is a code injection vulnerability (CWE-1236) triggered by insufficient neutralization of formula syntax in CSV input processing. The Pizzy Library fails to sanitize or escape formula characters—typically leading characters like '=', '+', '@', or '-' that trigger formula evaluation in spreadsheet applications—before processing CSV data. An authenticated user with permission to upload or import CSV files can craft malicious input containing formula injection payloads, leading to arbitrary code execution within the application's privilege context.

Business impact

Successful exploitation enables authenticated users to execute arbitrary code with the permissions of the Pizzy Library process. This can lead to unauthorized data access, modification, or destruction; lateral movement within the network; and potential compromise of downstream systems that consume or interact with the library. Organizations relying on Pizzy for data import workflows face direct risk to data integrity and confidentiality. The HIGH severity rating reflects the combination of high impact (confidentiality, integrity, availability all affected) and ease of exploitation once authentication is obtained.

Affected systems

MIA Technology Inc. Pizzy Library versions 1.0.0.26250 through 1.3.8.26250 are vulnerable. Any application or workflow integrating the Pizzy Library for CSV processing is affected if users can directly supply or influence CSV content. This includes data import pipelines, batch processing systems, and integration middleware that rely on this library.

Exploitability

Exploitation requires valid authentication credentials (PR:L in the CVSS vector) but does not require user interaction. An authenticated attacker with CSV upload or import privileges can trigger code injection without social engineering or additional clicks. Network accessibility (AV:N) means attacks can be mounted remotely. The low complexity (AC:L) indicates no special conditions are needed—any authenticated session is sufficient. Organizations with permissive access controls for data import functions face higher risk.

Remediation

Upgrade Pizzy Library to version 1.3.9.26250 or later. Verify the upgrade through vendor release notes and test in a non-production environment before deploying to production systems. No workarounds short of disabling CSV import functionality are known; patching is the primary mitigation path.

Patch guidance

Update all instances of Pizzy Library to version 1.3.9.26250 or a later supported release. Coordinate this with your application dependency management and testing cycle. Verify compatibility with your application version before deployment. Check MIA Technology Inc.'s official advisory for any additional upgrade prerequisites or breaking changes. If you cannot patch immediately, implement network segmentation to restrict access to CSV import features to trusted users only.

Detection guidance

Monitor for CSV file uploads or imports that contain unusual characters or formula syntax (e.g., '=', '+', '@', '-' at the start of cell values). Log and alert on authentication events preceding CSV import operations, especially from unusual locations or at off-hours. Inspect running processes spawned by Pizzy Library for unexpected child processes or privileged operations. Maintain audit logs of all data import activities and correlate with system behavior changes. Security scanning tools that detect formula injection payloads in file uploads may also be beneficial.

Why prioritize this

This vulnerability merits urgent attention due to its HIGH CVSS score (8.8), broad impact across confidentiality, integrity, and availability, and the ease with which authenticated users can exploit it. While authentication is required, many organizations permit multiple users to import data. The code execution capability and network accessibility make this a critical pathway for post-compromise lateral movement and data exfiltration. Prioritize patching in environments where CSV import is commonly used or where users have broad data import permissions.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) is driven by: (1) Network accessibility allowing remote exploitation, (2) low attack complexity requiring no special conditions, (3) authentication requirement reducing but not eliminating risk for typical environments, (4) full impact on confidentiality, integrity, and availability of the affected system, and (5) no scope boundary—the vulnerability is confined to the system running the library. This is a severe vulnerability that can enable complete system compromise.

Frequently asked questions