EUVD-2026-87486
GHSA-8m9f-8fvq-mwvm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote injection via freely-settable display name (PR:N); requires operator to open export in a formula app (UI:R); low client-side confidentiality/integrity impact on the viewer's machine, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in formula-enabled applications.
AnalysisAI
Spreadsheet formula injection in OpenClaw's attendance CSV export allows an attacker who controls a participant display name to embed formula payloads (cells beginning with =, +, -, @, tab or carriage return) that execute in the spreadsheet of anyone who opens the exported file in a formula-enabled application such as Excel or LibreOffice Calc, affecting all versions before 2026.8.1. Exploitation is unauthenticated per the supplied vectors (PR:N in both CVSS:4.0 and the assessed CVSS:3.1), but it is heavily gated: the attendance export must be generated, the attacker must control a name included in it, and a victim must open the CSV and permit formula evaluation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that the OpenClaw attendance CSV export feature is used, that an attacker can control a participant display name that gets included in the export, and - critically - that the operator opens the resulting CSV in a formula-enabled application (Excel, LibreOffice Calc) with automatic formula evaluation and without dismissing macro/formula-injection warnings. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority, high-nuance issue despite a 'medium' 5.3 score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to OpenClaw 2026.8.1 or later; this is a vendor-released patch (fix version 2026.8.1) documented in the GHSA advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-39hf-qg99-f4qv and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-csv-formula-injection-via-attendance-export. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today