EUVD-2026-38220Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered via web app, low complexity; PR:L for required account; UI:R for admin file open; S:C for formula execution in admin's spreadsheet environment; C:L for potential cell-data exfiltration.
Primary rating from Vendor (rami.io).
CVSS VectorVendor: rami.io
Lifecycle Timeline
2DescriptionCVE.org
Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file.
AnalysisAI
Formula injection in Venueless Excel exports allows an attacker with a low-privilege account to embed malicious spreadsheet formulas into user-supplied data fields, which execute when an administrator opens the generated export file. Affected deployments include all versions of Venueless (pretix) as indicated by the wildcard CPE entry. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the low attack complexity and the availability of a GitHub security advisory signal a credible, reproducible attack path against administrative workflows.
Technical ContextAI
Venueless is an open-source virtual event platform maintained by pretix, identified via CPE cpe:2.3:a:pretix:venueless:*:*:*:*:*:*:*:*. The vulnerability resides in the server-side Excel export functionality, which serializes untrusted user-submitted data directly into spreadsheet cells without sanitizing formula-triggering prefix characters (=, +, -, @, tab, carriage return). When the resulting .xlsx file is opened in spreadsheet software such as Microsoft Excel or LibreOffice Calc, the embedded formulas are evaluated by the client-side spreadsheet engine, potentially making outbound network requests to attacker-controlled servers or, in permissive configurations, executing DDE/shell commands. The assigned CWE is CWE-148 (Improper Neutralization of Input Leaders), though CWE-1236 (Improper Neutralization of Formula Elements in a CSV/spreadsheet File) is the more precise classification for this class of injection - the discrepancy is worth noting when cross-referencing NVD entries. The root cause is the absence of output encoding or cell-content prefixing (e.g., prepending a literal apostrophe to force string interpretation) before writing data to Excel cells.
RemediationAI
Consult the vendor security advisory at https://github.com/venueless/venueless/security/advisories/GHSA-5hw3-655h-7m86 for the patched release version and upgrade instructions; no specific fixed version was confirmed in the data available at time of analysis. As a compensating control prior to patching, administrators should avoid opening Excel exports generated from instances where untrusted users can submit arbitrary data, or should open such files in a sandboxed environment with external network access disabled to prevent formula-triggered data exfiltration. Disabling DDE and blocking external data connections in Excel via organizational Group Policy or Trust Center settings reduces the potential severity of any formula execution. These controls do not eliminate the injection itself and carry the trade-off of reduced spreadsheet functionality for legitimate use cases. If the platform allows restricting which data fields are included in exports, excluding free-text user-controlled fields is a partial mitigation.
Venueless instances allow authenticated users with 'update world' permissions to exfiltrate chat messages from direct me
Cross-world user deletion in venueless allows authenticated API users with 'manage users' permission in one world to del
Unvalidated redirect in Venueless social login allows phishing attacks by abusing the trusted domain reputation of legit
Incorrect authorization logic during room creation in Venueless permits authenticated low-privilege users to create room
Same weakness CWE-148 – Improper Neutralization of Input Leaders
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today