ERPGo SaaS version 3.9 contains a CSV injection vulnerability that allows authenticated attackers to execute arbitrary code. The vulnerability is located in the vendor name fields where attackers can inject malicious formulas. When exported CSV files containing these payloads are opened in spreadsheet applications, the malicious code executes. An example payload is =10+20+cmd|' /C calc'!A0 which can be injected through the vendor creation form. This represents a significant security risk as it enables code execution through a commonly used data export feature.