{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"12.3.1"}],"component":"tendenci","cve_ids":["CVE-2020-36962"],"ecosystem":"PyPI","epss":0.12462,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-4q3w-jgfx-4792","id":"tcs_01M5KGS4DJPMA0VBAQAKQH4AQC","modified_at":"2026-06-10T17:02:42.768061730Z","published_at":"2026-01-28T18:16:46.277Z","references":["https://osv.dev/vulnerability/PYSEC-2026-136","https://www.tendenci.com/","https://www.vulncheck.com/advisories/tendenci-csv-formula-injection","https://github.com/tendenci/tendenci","https://www.exploit-db.com/exploits/49145","https://github.com/advisories/GHSA-4q3w-jgfx-4792"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2026-136","url":"https://osv.dev/vulnerability/PYSEC-2026-136"}],"summary":"Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads"}