CVE-2026-5242: Code Injection in Mia Technologies' Pizzy Library

Synopsis

This is a code injection vulnerability in MIA Technology Inc.'s Pizzy Library, caused by improper neutralization of formula elements in CSV output. The vulnerability is reachable over the network by any authenticated user with a low-privilege account, and no victim interaction is required to trigger it. Successful exploitation gives an attacker full read, write, and availability impact on the affected component. A patched-image rebuild at version 1.3.9.26250 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network, meaning an attacker must be able to reach the service remotely to deliver a malicious CSV payload.

• AuthenticationRequired

  A low-privilege account is sufficient; no elevated or administrative credentials are needed to exploit this vulnerability.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the injection without involving any other party.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• Reads sensitive data from the affected environment, including any information accessible to the running process.
• Modifies application data or system state, as the integrity impact is rated High.
• Crashes or disrupts the availability of the affected service, as the availability impact is rated High.
• Combines all three impacts in a single exploit, making this vulnerability suitable for full application compromise.