CVE-2026-56652
Deferred Deferred - Pending Action

CSV Injection in Dool Data Export

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: CERT.PL

Description
Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting with =, which injects malicious formulas into the CSV output that execute when a victim opens the file in a spreadsheet application.  The issue was addressed by pull request #117

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-09-17
AI Q&A
2026-08-27
EPSS Evaluated
2026-09-15
NVD
CVE-2026-56652
EUVD
EUVD-2026-67128

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
scottchiefbaker dool to 1.3.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1236 The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-56652 is a CSV injection vulnerability in the dool tool versions up to 1.3.8. When exporting data to a CSV file, the tool fails to sanitize cell content starting with special characters like =, +, -, or @. An attacker can exploit this by naming a process with a crafted name beginning with these characters, which injects malicious formulas into the CSV output. When a victim opens the file in a spreadsheet application, the formulas execute, potentially leading to unauthorized actions.

Detection Guidance

Check for CSV files generated by dool versions up to 1.3.8 that contain cell values starting with =, +, -, or @. Inspect file contents for malicious formulas.

Impact Analysis

If you use dool versions up to 1.3.8 and export data to CSV files, an attacker could trick you into opening a malicious CSV file. This could lead to arbitrary code execution on your system when you open the file in a spreadsheet application, potentially compromising your data or system.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using affected dool versions may face compliance violations if exploited.

Mitigation Strategies

Upgrade dool to a version beyond 1.3.8 where the vulnerability is fixed. Avoid opening CSV files from untrusted sources in spreadsheet applications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56652. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart