πŸ” CVE Alert

CVE-2026-56652

UNKNOWN 0.0

Formula Injection in dool project

CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting with =, which injects malicious formulas into the CSV output that execute when a victim opens the file in a spreadsheet application.Β  The issue was addressed by pull request #117

CWE CWE-1236
Vendor scottchiefbaker
Product dool
Published Aug 27, 2026
Stay Ahead of the Next One

Get instant alerts for scottchiefbaker dool

Be the first to know when new unknown vulnerabilities affecting scottchiefbaker dool are published β€” delivered to Slack, Telegram or Discord.

Get Free Alerts β†’ Free Β· No credit card Β· 60 sec setup

Affected Versions

scottchiefbaker / dool
0 ≀ 1.3.8

References

NVD β†— CVE.org β†— EPSS Data β†—
github.com: https://github.com/scottchiefbaker/dool/pull/117 cert.pl: https://cert.pl/en/posts/2026/08/CVE-2026-56651

Credits

MichaΕ‚ Majchrowicz (AFINE) Marcin Wyczechowski (AFINE)