CVE-2026-64955
Velociraptor CSV Formula Injection in Export Pipeline
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not clear if the vulnerability is actually in Microsoft Excel treating a CSV data file as executable content, or if Velociraptor should be sanitizing the data to prevent Excel from executing it. However, since this is such a common use case for Velociraptor we decided to highlight it in an advisory.
| CWE | CWE-1236 |
| Vendor | rapid7 |
| Product | velociraptor |
| Published | Aug 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for rapid7 velociraptor
Be the first to know when new medium vulnerabilities affecting rapid7 velociraptor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Rapid7 / Velociraptor
0 < 0.77.2
References
Credits
Tristan Madani (Talence Security)