CVE-2026-129133

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-129133
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-129133.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-129133
Aliases
  • GHSA-9rvp-v4ff-wpwr
Published
2026-11-13T16:23:35Z
Modified
2026-11-14T02:47:33Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
MRBS before 1.13.0 CSV Formula Injection via Report Export
Details

MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape() function in web/report.php fails to neutralize leading formula characters. Attackers can store formulas in booking names, descriptions or custom fields that execute when privileged users open exported CSV reports, enabling data exfiltration or command execution via DDE.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-1236"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129133.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "1.13.0"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "1.13.0"
                        }
                    ],
                    "source": "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/meeting-room-booking-system/mrbs-code

Affected ranges

Type
GIT
Repo
https://github.com/meeting-room-booking-system/mrbs-code
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
92f6f5610072ddb9e1b38074c410fc8be56947ed
Fixed
383c98214deed41ee05ce2cd3e7a57c3f72a0af0
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "92f6f5610072ddb9e1b38074c410fc8be56947ed"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.13.0",
            "range": [
                {
                    "fixed": "383c98214deed41ee05ce2cd3e7a57c3f72a0af0"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

Other
mrbs-1_11_0
mrbs-1_2
mrbs-1_2_1
mrbs-1_2_2
mrbs-1_2_3
mrbs-1_2_4
mrbs-1_2_5
mrbs-1_2_6
mrbs-1_2_6_1
mrbs-1_4
mrbs-1_4_1
mrbs-1_4_10
mrbs-1_4_11
mrbs-1_4_2
mrbs-1_4_2rc1
mrbs-1_4_3
mrbs-1_4_4
mrbs-1_4_4_1
mrbs-1_4_5
mrbs-1_4_5rc1
mrbs-1_4_5rc2
mrbs-1_4_6
mrbs-1_4_7
mrbs-1_4_8
mrbs-1_4_9
mrbs-1_4_b1
mrbs-1_4beta1
mrbs-1_4beta2
mrbs-1_5_0
mrbs-1_6_0
mrbs-1_7_0
mrbs-1_7_1
mrbs-1_7_2
mrbs-1_8_0
mrbs-1_9_0
mrbs-1_9_1
mrbs-1_9_2
mrbs-1_9_3
mrbs-1_9_4
v1.*
v1.11.1
v1.11.2
v1.11.5
v1.11.6
v1.12.2
v1.12.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-129133.json"