ERPGo SaaS 3.9 contains a CSV injection flaw that allows authenticated users to insert spreadsheet formulas directly into the vendor name field. When a vendor list is exported to CSV and opened in a spreadsheet application, the embedded formula executes on the victim’s workstation. Sample payloads such as =10+20+cmd|' /C calc'!A0 demonstrate that the injection can trigger arbitrary code execution.

The flaw is present in ERPGo SaaS version 3.9 as distributed by Rajodiya. No other affected versions are documented in the available data, and Rajodiya is the sole vendor identified.

The CVSS base score of 8.7 indicates high severity, but the EPSS score of less than 1% reflects a very low probability of exploitation, and the vulnerability is not catalogued in the CISA KEV list. Exploitation requires an authenticated account that can create vendors and export the data, and it depends on a victim who opens the malicious CSV in a spreadsheet program. It is inferred that the attacker must rely on a target opening the exported file for execution, so the immediate threat is limited to users who handle exported CSVs from the application.