EUVD-2026-57158
GHSA-x3cx-8mg8-hcv2
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Network vector because attacker data traverses network to Velociraptor; AC:H for the required analyst export-and-open chain; S:C and C:H because execution and impact occur in Excel on the analyst workstation.
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution.
Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports.
It is not clear if the vulnerability is actually in Microsoft Excel treating a CSV data file as executable content, or if Velociraptor should be sanitizing the data to prevent Excel from executing it. However, since this is such a common use case for Velociraptor we decided to highlight it in an advisory.
AnalysisAI
CSV formula injection in Velociraptor's export pipeline allows attacker-controlled endpoint artifacts to execute as formulas when a forensic analyst opens the exported CSV in Microsoft Excel. Affected export paths include the GUI, offline collector, and data export features - any of which may produce unsanitized CSV output when collected data contains leading formula-trigger characters (=, +, -, @, tab). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three specific conditions to align: first, attacker-controlled data containing formula-triggering leading characters (=, +, -, @, tab) must exist in a field that Velociraptor collects - achievable via registry values, filenames, process command lines, log entries, or other artifact types; second, a Velociraptor analyst must export that collected data to CSV using any of the affected export surfaces (GUI, offline collector, or data export); third, the analyst must open the resulting CSV file in Microsoft Excel rather than a plain-text viewer. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS score of 6.1 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) is internally consistent with the attack model: network vector because attacker-controlled data traverses the network to reach Velociraptor, high complexity because a specific chain of analyst actions is required, no privileges for the attacker, and required user interaction (analyst must export to CSV and open in Excel). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has established a foothold on a monitored endpoint deliberately creates a malicious registry value or filename containing a DDE formula payload such as =cmd|' /c calc'!A0. When Velociraptor collects this artifact during routine or incident-driven investigation and an analyst exports the results to CSV for further analysis, the payload is written unsanitized into the output file. … |
| Remediation | Consult the vendor advisory at http://docs.velociraptor.app/announcements/advisories/cve-2026-64955/ for the patched release version - the exact fix version was not available in the provided intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today