CVE-2026-129133

MEDIUM 5.4

MRBS before 1.13.0 CSV Formula Injection via Report Export

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape() function in web/report.php fails to neutralize leading formula characters. Attackers can store formulas in booking names, descriptions or custom fields that execute when privileged users open exported CSV reports, enabling data exfiltration or command execution via DDE.

CWE	CWE-1236
Vendor	meeting-room-booking-system
Product	mrbs-code
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for meeting-room-booking-system mrbs-code

Be the first to know when new medium vulnerabilities affecting meeting-room-booking-system mrbs-code are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

meeting-room-booking-system / mrbs-code

0 < 1.13.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-9rvp-v4ff-wpwr github.com: https://github.com/meeting-room-booking-system/mrbs-code/commit/92f6f5610072ddb9e1b38074c410fc8be56947ed github.com: https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.13.0 github.com: https://github.com/meeting-room-booking-system/mrbs-code/blob/299686ed64174a66448699f5ca0fb5e0e0ea9faa/web/report.php#L542-L543 vulncheck.com: https://www.vulncheck.com/advisories/mrbs-before-1.13.0-csv-formula-injection-via-report-export

Credits

leediay153 from Viettel Post John Beranek