EUVD-2026-22253
GHSA-px5r-qp49-693q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Injection point is unauthenticated network-facing (PR:N/AV:N), but formula execution requires an operator to open the export (UI:R) and detonates on their workstation, a scope change (S:C).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code and escalate privileges via the CSV registration field
AnalysisAI
Formula/CSV injection in HostBill billing automation builds 2025-11-24 and 2025-12-01 lets a remote unauthenticated attacker plant malicious spreadsheet formulas through a user-facing registration field, which are later exported and detonated when an operator opens the generated CSV, yielding code execution on the operator's workstation and potential privilege escalation. Tracked as CWE-1236 with a 9.8 CVSS and SSVC classifying it as PoC-available, automatable, with total technical impact; publicly available exploit code exists via a third-party GitHub write-up, but it is not on CISA KEV and EPSS is low at 0.10% (28th percentile). The vendor has published a security advisory and release notes covering the affected builds.
Technical ContextAI
HostBill is commercial billing, automation, and client-management software used by web hosting and cloud resellers, exposing customer-facing registration/signup forms and administrative CSV import/export tooling. The root cause is CWE-1236 (Improper Neutralization of Formula Elements in a CSV File): attacker-controlled text entered into a registration field is stored without neutralizing leading characters such as '=', '+', '-', or '@', so when an administrator exports client records to CSV and opens them in a spreadsheet application (Excel, LibreOffice, Google Sheets), the field is interpreted as a live formula. Such formulas can invoke DDE, external data connections, or command execution in the spreadsheet engine, which is the mechanism behind the 'arbitrary code execution and privilege escalation' claim. CPE data is uninformative (cpe:2.3:a:n/a:n/a:*), so exact affected product identification relies on the description and vendor references rather than NVD's CPE dictionary.
RemediationAI
Patch available per vendor advisory: upgrade HostBill to the build referenced in the 2025-12-03 security advisory (https://blog.hostbillapp.com/2025/12/03/hostbill-security-advisory/) and the release notes at https://hostbillapp.com/release-notes/12-01-2025.html and https://hostbillapp.com/release-notes/11-27-2025.html - the exact fixed build number is not independently confirmed from the provided data, so verify the target version against the changelog (https://hostbillapp.com/changelog) before deploying. As compensating controls until patched: enforce server-side input validation on all registration fields to reject or neutralize leading formula characters (prefix '=','+','-','@','\t','\r' with a single quote or strip them), which prevents payload storage without breaking legitimate signups; disable or restrict the client CSV export/import feature to trusted admins only, accepting reduced reporting convenience; and configure spreadsheet clients used by staff to disable automatic formula/DDE execution and external data connections when opening untrusted CSVs, at the cost of manual re-enabling for trusted files. Report handling follows the vendor's responsible-disclosure page (https://hostbillapp.com/responsible-disclosure).
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Share
External POC / Exploit Code
Leaving vuln.today