[HIGH] FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export

PKSA-9nsq-164p-6ppm CVE-2026-45263 GHSA-2p5x-4jr6-x5jg

Affected package: facturascripts/facturascripts

Affected version: <=2026.1

Reported by:
GitHub