CVE-2026-56652: Formula Injection in dool project
Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting with =, which injects malicious formulas into the CSV output that execute when a victim opens the file in a spreadsheet application. The issue was addressed by pull request #117
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
doolto a version that resolves this vulnerability.Fixed in 1.3.8Patch pull request #117
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who export Dool data to CSV and then open the resulting file in a spreadsheet application are exposed. Exploitation requires that the exported data include a process name crafted to begin with =, +, -, or @.
What access does an attacker need?
The attacker needs local access sufficient to run a process with a crafted name on the system where Dool collects data. The malicious formula executes only when a victim opens the generated CSV in a spreadsheet application.
How can I tell whether CSV output may be affected?
Inspect exported CSV files for cell values, particularly process names, beginning with =, +, -, or @. Such values may be interpreted as spreadsheet formulas when the file is opened.
What can be done if updating is not immediately possible?
Avoid opening Dool CSV exports in spreadsheet applications when process names may be attacker-controlled. Review or sanitize cells beginning with =, +, -, or @ before opening the file.