CVE-2022-21241: Csv+ Project Csv+

Critical severity, CVSS 9.6. EPSS: 3.2% chance of exploitation in the next 30 days.

Cross-site scripting vulnerability in CSV+ prior to 0.8.1 allows a remote unauthenticated attacker to inject an arbitrary script or an arbitrary OS command via a specially crafted CSV file that contains HTML a tag.

Affected products

• Csv+ Project Csv+: before 0.8.1 (fixed in 0.8.1)

Published 2022-02-08. Last modified 2026-06-17.