CVE-2026-56652
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Dool up to version 1.3.8 is vulnerable to CSV injection when exporting data to CSV, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting with =, injecting malicious formulas into the CSV output that execute when opened in a spreadsheet.
Risk Assessment
Opening a malicious CSV file may lead to unintended formula execution, potentially causing data loss or further attacks.
Recommendation
Update Dool to a patched version (pull request #117) and avoid opening CSV files from untrusted sources.
Original NVD description (English source)
Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting with =, which injects malicious formulas into the CSV output that execute when a victim opens the file in a spreadsheet application. The issue was addressed by pull request #117