CVE-2021-23654: 
Python vulnerability analysis and mitigation

CVE-2021-23654 affects all versions of the html-to-csv Python package. The vulnerability was discovered and disclosed on November 26, 2021. This security issue involves improper validation of formula elements in HTML pages when converting them to CSV format (NVD, Snyk).

The vulnerability is classified as CWE-1236 (Improper Neutralization of Formula Elements in a CSV File). It has received a CVSS v3.1 base score of 9.8 (CRITICAL) from NVD and 5.6 (MEDIUM) from Snyk. The vulnerability exists in the converter functionality where formulas embedded in HTML pages are accepted without proper validation during the conversion process to CSV format (NVD, Snyk).

When exploited, this vulnerability allows malicious actors to embed or generate malicious links and execute commands through CSV files. The impact affects the confidentiality, integrity, and availability of systems using the vulnerable package, with potential for command execution and data manipulation (Snyk).

The vulnerability is remotely exploitable with network access, requiring no privileges or user interaction. The attack complexity is rated as high by Snyk but low by NVD, indicating some discrepancy in assessment. The vulnerability has been confirmed to affect all versions of the html-to-csv package (NVD, Snyk).

Currently, there is no fixed version available for the html-to-csv package. Users should consider implementing additional validation mechanisms or exploring alternative solutions for HTML to CSV conversion (Snyk).