Dool CVE-2026-56652

Two specific, sequential conditions must both be met. First, the attacker must have local execution capability on the system being monitored by Dool - sufficient to spawn a process whose name begins with =, +, -, or @. This is a non-default, privilege-dependent condition: on most Linux systems, any authenticated local user can start a process, but the attacker must already have local access. Second, a victim (typically a system administrator) must export Dool's output to CSV and then open that file in a spreadsheet application on a workstation with formula auto-execution enabled - this constitutes the UI:A (active user interaction) requirement in the CVSS 4.0 vector. Exploitation is bounded to the spreadsheet application's context on the victim's workstation, not the monitored server. CVSS PR:N indicates no special privilege is required to name a process - only local access itself is the gate. Exploitation is not possible remotely (AV:L) and cannot proceed without the victim's active file-open action.

The CVSS 4.0 score of 4.6 with AV:L/PR:N/UI:A accurately reflects the constrained exploitation model: the attacker must have local access to the monitored system to launch a crafted process, and separately a victim must actively open the exported CSV in a spreadsheet application with formula execution enabled. Both conditions must be satisfied, making opportunistic mass exploitation unlikely. No EPSS data was supplied in the input, and this vulnerability does not appear on the CISA KEV list, consistent with no confirmed in-the-wild exploitation. The absence of public exploit code further reduces near-term risk. Real-world impact is primarily relevant in shared multi-user Linux environments where analysts routinely export Dool CSV snapshots to workstations - for most single-administrator monitoring setups the threat model is narrow. The VI:L/SC:N rating in the provided CVSS 4.0 vector is conservative; independent assessment suggests the integrity impact falls on the subsequent-system (spreadsheet) rather than Dool itself, which may warrant SC:L/SI:L framing. CERT-PL's disclosure provides the authoritative characterization; CVSS vector details are confirmed, but patch version is not independently verified.

A low-privileged local user on a shared Linux monitoring host launches a background process named '=cmd|"/C powershell -enc <base64payload>"!A1' (or a Linux macro equivalent targeting the spreadsheet client). A system administrator later runs Dool, collects a snapshot of running processes, and exports the output to a CSV file for offline review. When the administrator opens the CSV in Microsoft Excel on their Windows workstation, the injected formula executes in Excel's context, potentially triggering DDE-based command execution or data exfiltration to an attacker-controlled endpoint.