CVE-2026-14846: PrestaShop XSS Vulnerability

CVE-2026-14846 Overview

CVE-2026-14846 is a CSV injection vulnerability affecting PrestaShop version 8.2.1. The flaw stems from inadequate validation of the Alias parameter within the Update your address function. An authenticated attacker can inject spreadsheet formula expressions into this field. These expressions execute when a victim exports account data using the Get my data in CSV tool. Successful exploitation can lead to unauthorized disclosure of the victim's personal data. The weakness is tracked as [CWE-1236: Improper Neutralization of Formula Elements in a CSV File].

Critical Impact
Formula injection into exported CSV files can facilitate unauthorized access to victim personal data when opened in spreadsheet applications.

Affected Products

PrestaShop version 8.2.1
Storefronts using the address management module
Customer accounts leveraging the CSV data export feature

Discovery Timeline

2026-07-13 - CVE-2026-14846 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-14846

Vulnerability Analysis

The vulnerability is a CSV formula injection issue [CWE-1236]. PrestaShop stores user-supplied input from the Alias field of the address form without neutralizing spreadsheet formula prefix characters such as =, +, -, and @. When the customer later invokes the Get my data in CSV export function, the stored value is written verbatim into the resulting CSV file. Opening this file in a spreadsheet application, such as Microsoft Excel or LibreOffice Calc, causes the client to interpret the crafted content as a formula rather than plain text. This shifts execution context from the web application to the victim's spreadsheet client. Exploitation requires an authenticated session and user interaction to open the exported file.

Root Cause

The root cause is missing output-side neutralization of formula-triggering characters during CSV serialization. Input validation on the Alias parameter does not strip or escape leading =, +, -, @, tab, or carriage return characters. The export routine does not prefix untrusted cells with a safe character such as a single quote.

Attack Vector

An attacker with access to the victim's address form, or one who tricks the victim into saving a crafted alias, submits a payload beginning with a formula prefix. When the victim later exports personal data through the CSV feature and opens the file, the spreadsheet engine evaluates the payload. Refer to the INCIBE Security Notice for advisory details.

Detection Methods for CVE-2026-14846

Indicators of Compromise

Address Alias field values beginning with =, +, -, or @ characters.
Exported CSV files containing cells with WEBSERVICE, HYPERLINK, IMPORTXML, or DDE functions.
Outbound HTTP requests originating from spreadsheet client processes shortly after CSV download.

Detection Strategies

Inspect PrestaShop database address.alias values for entries starting with formula-trigger characters.
Review web server logs for POST requests to the address update endpoint containing suspicious leading characters in the alias parameter.
Scan generated CSV exports for cells that would be interpreted as formulas by common spreadsheet applications.

Monitoring Recommendations

Alert on spreadsheet applications spawning network connections or child processes after opening user-downloaded CSV files.
Monitor endpoints for excel.exe or soffice.bin initiating outbound traffic to non-corporate destinations.
Track anomalous access to customer personal data export endpoints for accounts with recently modified address aliases.

How to Mitigate CVE-2026-14846

Immediate Actions Required

Audit stored address Alias values in the PrestaShop database and sanitize entries beginning with =, +, -, or @.
Restrict access to the Get my data in CSV export function until the merchant applies a patched build.
Warn shop administrators and customers about the risk of opening exported CSV files from untrusted sources.

Patch Information

No vendor patch reference is listed in the NVD entry at publication time. Consult the INCIBE Security Notice and monitor PrestaShop security releases for a fix that neutralizes formula prefixes in the CSV export routine and validates address form input.

Workarounds

Apply server-side input validation that rejects or escapes leading =, +, -, @, tab, and carriage return characters in the Alias parameter.
Modify the CSV export function to prepend a single quote (') to any cell value starting with a formula-trigger character.
Configure spreadsheet clients to disable automatic formula evaluation and dynamic data exchange for downloaded files.

bash

# Configuration example: neutralize formula prefixes during CSV export
# Pseudocode for the CSV serialization routine
sanitize_cell() {
  value="$1"
  case "$value" in
    =*|+*|-*|@*|$'\t'*|$'\r'*)
      printf "'%s" "$value"
      ;;
    *)
      printf "%s" "$value"
      ;;
  esac
}