CVE-2021-41270

Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Symfony versions 4.1.0 before 4.4.35 and versions 5.0.0 before 5.3.12 are vulnerable to CSV injection, also known as formula injection. In Symfony 4.1, maintainers added the opt-in `csv_escape_formulas` option in the `CsvEncoder`, to prefix all cells starting with `=`, `+`, `-` or `@` with a tab `\t`. Since then, OWASP added 2 chars in that list: Tab (0x09) and Carriage return (0x0D). This makes the previous prefix char (Tab `\t`) part of the vulnerable characters, and OWASP suggests using the single quote `'` for prefixing the value. Starting with versions 4.4.34 and 5.3.12, Symfony now follows the OWASP recommendations and uses the single quote `'` to prefix formulas and add the prefix to cells starting by `\t`, `\r` as well as `=`, `+`, `-` and `@`.

• CWE-1236

• https://github.com/symfony/symfony/commit/3da6f2d45e7536ccb2a26f52fbaf340917e208a8Patch, Third Party Advisory
• https://github.com/symfony/symfony/pull/44243Patch, Third Party Advisory
• https://github.com/symfony/symfony/releases/tag/v5.3.12Release Notes, Third Party Advisory
• https://github.com/symfony/symfony/security/advisories/GHSA-2xhg-w2g5-w95xPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BPT4SF6SIXFMZARDWED5T32J7JEH3EP/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QSREFD2TJT5LWKM6S4MD3W26NQQ5WJUP/
• https://github.com/symfony/symfony/commit/3da6f2d45e7536ccb2a26f52fbaf340917e208a8Patch, Third Party Advisory
• https://github.com/symfony/symfony/pull/44243Patch, Third Party Advisory
• https://github.com/symfony/symfony/releases/tag/v5.3.12Release Notes, Third Party Advisory
• https://github.com/symfony/symfony/security/advisories/GHSA-2xhg-w2g5-w95xPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BPT4SF6SIXFMZARDWED5T32J7JEH3EP/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QSREFD2TJT5LWKM6S4MD3W26NQQ5WJUP/

Published

Nov 24, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41265Flask-AppBuilder is a development framework built on top of …8.8
• CVE-2021-41266Minio console is a graphical user interface for the for MinI…9.8
• CVE-2021-41267Symfony/Http-Kernel is the HTTP kernel component for Symfony…6.5
• CVE-2021-41268Symfony/SecurityBundle is the security system for Symfony, a…8.8
• CVE-2021-41269cron-utils is a Java library to define, parse, validate, mig…9.8
• CVE-2021-4127An out of date graphics library (Angle) likely contained vul…9.8
• CVE-2021-41271Discourse is a platform for community discussion. In affecte…5.3
• CVE-2021-41272Besu is an Ethereum client written in Java. Starting in vers…7.5
• CVE-2021-41273Pterodactyl is an open-source game server management panel b…4.3
• CVE-2021-41274solidus_auth_devise provides authentication services for the…8.8
• CVE-2021-41275spree_auth_devise is an open source library which provides a…8.8
• CVE-2021-41276Tuleap is a Libre and Open Source tool for end to end tracea…7.2