The issue was addressed by pull request #117
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| scottchiefbaker | dool | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 27 Aug 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting with =, which injects malicious formulas into the CSV output that execute when a victim opens the file in a spreadsheet application. The issue was addressed by pull request #117 | |
| Title | Formula Injection in dool project | |
| First Time appeared |
Scottchiefbaker
Scottchiefbaker dool |
|
| Weaknesses | CWE-1236 | |
| CPEs | cpe:2.3:a:scottchiefbaker:dool:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Scottchiefbaker
Scottchiefbaker dool |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: CERT-PL
Published:
Updated: 2026-08-27T19:40:33.602Z
Reserved: 2026-06-22T15:34:38.576Z
Link: CVE-2026-56652
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-27T17:18:51.990
Modified: 2026-08-27T17:18:51.990
Link: CVE-2026-56652
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-1236
Improper Neutralization of Formula Elements in a CSV File