CVE-2026-86020: Part-DB: Spreadsheet Formula Injection in XLSX Part Exports
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet's setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Part-DBto a version that resolves this vulnerability.Fixed in 2.13.2
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from the resulting file?
An authenticated user who has permission to import parts can supply formula-prefixed values in a CSV import. A different user is exposed when they export the affected parts to XLSX and open that spreadsheet in software that evaluates the formula.
Which workflow is affected?
The issue requires a CSV part import containing attacker-controlled values in user-controlled part fields, followed by an XLSX export. The unsafe formula is created during export because the value is written as a spreadsheet cell value without neutralising formula characters.
What should be done if upgrading cannot happen immediately?
Restrict the ability to import parts to trusted users and treat XLSX exports containing imported part data as potentially unsafe. Avoid opening such exports in spreadsheet software that may evaluate formulas until the affected data has been reviewed or remediated.
How can we determine whether an export may be affected?
Review CSV imports made by users permitted to import parts for values beginning with spreadsheet formula characters, such as =. Parts containing those values may produce formula cells when exported to XLSX in versions before 2.13.2.
What version fixes the vulnerability?
Part-DB version 2.13.2 patches this issue. Versions prior to 2.13.2 are affected.