CVE-2026-64955
Received Received - Intake

Microsoft Excel Formula Injection in Velociraptor CSV Export

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: Rapid7, Inc.

Description
When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution.  Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not clear if the vulnerability is actually in Microsoft Excel treating a CSV data file as executable content, or if Velociraptor should be sanitizing the data to prevent Excel from executing it. However, since this is such a common use case for Velociraptor we decided to highlight it in an advisory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-64955
EUVD
EUVD-2026-57158

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
velociraptor velociraptor 0.77.2
microsoft excel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1236 The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves CSV formula injection during export operations in Velociraptor. When Velociraptor exports data to CSV files, it fails to sanitize cells that begin with certain characters. Microsoft Excel interprets these cells as formulas and executes them, potentially allowing arbitrary code execution if the CSV is opened in Excel.

Detection Guidance

Check Velociraptor export logs for CSV files containing cells starting with formula characters like =, +, -, or @. Inspect exported CSVs manually for suspicious formula-like entries before opening in Excel.

Impact Analysis

If you use Velociraptor to export data to CSV and open the file in Microsoft Excel, an attacker could craft a CSV file that executes arbitrary code when opened. This could lead to unauthorized access or control of your system. The impact is limited to confidentiality as the CVSS score indicates high confidentiality impact but no integrity or availability impact.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration if exploited, potentially violating GDPR or HIPAA requirements for data protection and confidentiality. Organizations using Velociraptor for data exports must ensure proper safeguards to prevent CSV formula injection to maintain compliance.

Mitigation Strategies

Upgrade Velociraptor to version 0.77.2 or later. Avoid opening exported CSV files in Microsoft Excel or Google Docs. Use LibreOffice instead. Review existing CSV exports for potential formula injections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64955. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart