CVE-2026-9101

MediumCVSS 4.3

Published: 20/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

34th percentile - higher than 34% of all known CVEs

Summary

Prototype pollution in CSV parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior, enabling '1-click' command execution.

Risk Assessment

Risk of remote code execution if an attacker tricks a user into importing a malicious CSV file. This could lead to system compromise.

Recommendation

Update the software to a version that fixes this vulnerability. Avoid importing CSV files from untrusted sources.

Original NVD description (English source)

Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.