What is the CVSS score of CVE-2026-23873?

CVE-2026-23873 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-23873?

Yes, a public proof-of-concept exploit is available for CVE-2026-23873. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-23873?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

Hustoj CVE-2026-23873

CRITICAL

Improper Neutralization of Formula Elements in a CSV File (CWE-1236)

2026-01-22 security-advisories@github.com

PHP Linux MySQL Hustoj

9.0

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Register account with formula in Nickname field
Exploit

Administrator exports contest rank list
Execution

Excel interprets formula during file open
Impact

Arbitrary code execution in Excel context

Vulnerability Assessment

Weakness	CWE CWE-1236 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V1 - Encoding and Sanitization CSV injection prevention
Exploitation Conditions	Authenticated user account required to set malicious Nickname field. Administrator must export rank list via contestrank.xls.php or admin/ranklist_export.php and open exported .xls file in Microsoft Excel with formula execution enabled.
Impact	CVSS 9.0 with PoC. HUSTOJ is used by universities and competitive programming communities. Administrators regularly export submission data, making exploitation likely.
Exploit ScenarioDerived	A participant submits a solution containing a CSV formula payload in the username or code comments. When an admin exports results to CSV and opens in Excel, the formula executes, potentially stealing credentials or installing malware.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

HUSTOJ online judge system has a CSV injection vulnerability in all versions that allows code execution through crafted submissions exported to spreadsheets.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:54 CVSS 9.0

CSV injection in HUSTOJ online judge enables code execution through exported data.

RemediationAI

Sanitize CSV exports by prefixing cells with a single quote. Update HUSTOJ when patches are available.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

HUSTOJ (all versions) fails to sanitize user-submitted content (CWE-1236) when exporting data to CSV format. Malicious formula injections (e.g., =CMD()) execute when administrators open exported spreadsheets in Excel or LibreOffice.

Know when Hustoj gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Feb 27, 2026 - 15:02 vuln.today

Public exploit code

CVE Published

Jan 22, 2026 - 00:15 nvd

CRITICAL 9.0

DescriptionGitHub Advisory

hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Injection) through the contest rank export functionality (contestrank.xls.php and admin/ranklist_export.php). The application fails to sanitize user-supplied input (specifically the "Nickname" field) before exporting it to an .xls file (which renders as an HTML table but is opened by Excel). If a malicious user sets their nickname to an Excel formula when an administrator exports and opens the rank list in Microsoft Excel, the formula will be executed. This can lead to arbitrary command execution (RCE) on the administrator's machine or data exfiltration. A fix was not available at the time of publication.

Executive ViewAI

Why It Matters

Organizations using hustoj face critical risk from CVE-2026-23873 rated CVSS 9.0. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. Proof-of-concept code is publicly available, increasing the risk of exploitation. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score

0.0%

Top 95% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.