ERPGo SaaS 3.9 contains a CSV injection flaw in the vendor creation form. An authenticated user can insert spreadsheet formula payloads such as =10+20+cmd|' /C calc'!A0 into the vendor name field. When the vendor list is exported to CSV and opened in a spreadsheet application, the injected formula is executed, potentially granting the attacker arbitrary code execution on the victim’s machine. While the exploit begins with authentication to the SaaS platform, the dangerous payload is triggered locally when the user opens the exported CSV.

The vulnerability affects ERPGo SaaS version 3.9 distributed by Rajodiya. No additional affected versions are listed in the available data.

The CVSS base score of 8.7 reflects a high severity level, indicating considerable potential impact and a relatively high exploitation likelihood. The exploit requires an authenticated account and the ability to export vendor data, making it relatively straightforward for an attacker with user access. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to trigger the payload locally by opening the malicious CSV in a spreadsheet program, so the immediate threat is to users who open exported files. Because the flaw is directly injected into user-supplied data and relies on common spreadsheet processing, it is considered a classic CSV injection vector.