CVE-2026-19501

Name of the Vulnerable Software and Affected Versions Brainstorm Force SureForms versions prior to 2.12.2

Description The CSV export functionality fails to neutralize spreadsheet formula characters in user-controlled form field names before generating exports. This allows a remote attacker to execute spreadsheet formulas on an administrator's workstation when the exported CSV file is opened in a vulnerable spreadsheet application. This issue is a form of CSV Injection, where untrusted input is inserted into a CSV file and executed as a formula by the spreadsheet software.

Recommendations Update Brainstorm Force SureForms to version 2.12.2 or later.