CVE-2026-64955: Velociraptor CSV Formula Injection in Export Pipeline
When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution.
Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports.
It is not clear if the vulnerability is actually in Microsoft Excel treating a CSV data file as executable content, or if Velociraptor should be sanitizing the data to prevent Excel from executing it. However, since this is such a common use case for Velociraptor we decided to highlight it in an advisory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64955?
The severity of CVE-2026-64955 is classified as medium with a score of 6.1.
How do I fix CVE-2026-64955?
To fix CVE-2026-64955, ensure proper sanitization of CSV content before exporting from Velociraptor.
What causes CVE-2026-64955?
CVE-2026-64955 is caused by Velociraptor failing to sanitize cells that are executed as formulas when exporting to CSV.
What impact does CVE-2026-64955 have on users?
CVE-2026-64955 can lead to arbitrary code execution when a CSV file is imported into Microsoft Excel.
In which software is CVE-2026-64955 found?
CVE-2026-64955 is found in Velociraptor software.