PT-2026-4923 · Knockpy · Knockpy

Dolev Farhi · Published 2026-01-27 · Updated 2026-01-27 · CVE-2020-36941

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Knockpy version 4.1.1

Description Knockpy 4.1.1 has a flaw where malicious formulas can be inserted into CSV reports due to unfiltered server headers. An attacker can manipulate server response headers to include spreadsheet formulas that will run when the CSV file is opened in spreadsheet software.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2020-36941

Affected Products

Knockpy

References · 6

• 🔥 https://github.com/guelfoweb/knock · Exploit
• 🔥 https://exploit-db.com/exploits/49342 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36941 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36941 · Vendor Advisory
• https://t.me/CVEtracker/43068 · Telegram Post
• https://vulncheck.com/advisories/knockpy-csv-injection · Note