CVE-2025-52386

Description

CycloneDX Sunshine v0.9 is vulnerable to CSV Formula Injection via a crafted JSON file

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/CycloneDX/Sunshine ↗
• https://github.com/VishalSreenivas/Formula-Injection-in-CycloneDX-Sunshine/blob/main/payload.json ↗
• https://github.com/VishalSreenivas/Formula-Injection-in-CycloneDX-Sunshine/blob/main/CVE-2025-52386.md ↗