CVE-2021-23654

This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a malicious link or execute commands via CSV files.

• CWE-1236

• https://github.com/hanwentao/html2csv/blob/master/html2csv/converter.pyExploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-PYTHON-HTMLTOCSV-1582784Exploit, Third Party Advisory
• https://github.com/hanwentao/html2csv/blob/master/html2csv/converter.pyExploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-PYTHON-HTMLTOCSV-1582784Exploit, Third Party Advisory

Published

Nov 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23631This affects all versions of package convert-svg-core; all v…7.5
• CVE-2021-23632All versions of package git are vulnerable to Remote Code Ex…9.8
• CVE-2021-23639The package md-to-pdf before 5.0.0 are vulnerable to Remote …9.8
• CVE-2021-2364Vulnerability in the Oracle iSupplier Portal product of Orac…8.1
• CVE-2021-23648The package @braintree/sanitize-url before 6.0.0 are vulnera…6.1
• CVE-2021-2365Vulnerability in the Oracle Human Resources product of Oracl…8.1
• CVE-2021-2366Vulnerability in the Primavera P6 Enterprise Project Portfol…6.4
• CVE-2021-23663All versions of package sey are vulnerable to Prototype Poll…9.8
• CVE-2021-23664The package @isomorphic-git/cors-proxy before 2.7.1 are vuln…7.5
• CVE-2021-2367Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-23673This affects all versions of package pekeupload. If an attac…6.1
• CVE-2021-2368Vulnerability in the Siebel CRM product of Oracle Siebel CRM…5.9