CVE Intelligence
Analysis AI-assisted

CVE-2021-47901: Dirsearch CSV Injection via --csv-report

Dirsearch 0.4.1 contains a CSV injection weakness in reports generated with the --csv-report flag. Attackers may influence report content through redirected endpoints so that spreadsheet formulas end up in the CSV. The record gives a CVSS 3.1 base score of 9.8 and does not list the CVE in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Dirsearch 0.4.1 is associated with a CSV injection weakness (CWE-1236) in the report produced with the --csv-report flag. According to the record, content from redirected endpoints can end up in the generated CSV, where spreadsheet formulas could be carried into the report.

Impact

  • The record describes manipulation of the generated CSV report through crafted redirects.
  • Spreadsheet applications that open such files may interpret injected content as formulas. This is an inference from the CWE classification, not a confirmed outcome in the record.
  • The CVSS 3.1 base score is 9.8 (critical). VulnCheck also supplies a CVSS 4.0 score of 5.1.

Affected products and versions

  • The record identifies Dirsearch 0.4.1 as affected.
  • The affected products list in the record is empty, so the full range of affected versions is unknown.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The record references an Exploit-DB entry, but this analysis does not describe its content.

Remediation and mitigation

  • The record lists no fixed version. Check the upstream project at GitHub and the VulnCheck advisory for updates.
  • Treat CSV reports generated from scanned targets as untrusted data.
  • Avoid opening generated reports directly in spreadsheet software without reviewing their contents first.
  • Where operationally possible, limit scanning of untrusted targets that may issue unexpected redirects.

Detection guidance

  • Review generated CSV files for cells that begin with characters that spreadsheets may interpret as formula prefixes.
  • Monitor scanner output for unexpected redirect chains returned by scanned hosts.

Limitations of the available information

  • The record has no affected or fixed version list beyond the description, and no EPSS or SSVC data.
  • Several fields in the record are null, so their values are unknown.
  • The record was published on 2026-01-27 with a 2021-series identifier. The sources do not explain this difference.

Frequently asked questions

What is the core issue in CVE-2021-47901?

The record describes a CSV injection weakness in Dirsearch 0.4.1 when the --csv-report flag is used. Content from redirected endpoints can influence the generated CSV report.

Is there a confirmed fix for this CVE?

The record lists no fixed version. Check the upstream Dirsearch project and the VulnCheck advisory for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.