CVE-2018-20752: Recon-NG Project Recon-NG

Critical severity, CVSS 9.8. EPSS: 3.4% chance of exploitation in the next 30 days.

An issue was discovered in Recon-ng before 4.9.5. Lack of validation in the modules/reporting/csv.py file allows CSV injection. More specifically, when a Twitter user possesses an Excel macro for a username, it will not be properly sanitized when exported to a CSV file. This can result in remote code execution for the attacker.

Affected products

• Recon-NG Project Recon-NG: before 4.9.5 (fixed in 4.9.5)

Published 2019-02-04. Last modified 2026-06-17.