Dool
Monthly
Symlink following in Dool (versions up to and including 1.3.8) allows a local attacker to cause arbitrary file truncation and overwriting when the tool is run with the non-default '--devel' flag. The vulnerable code path opens a log file without the O_NOFOLLOW flag (CWE-59), allowing a pre-placed symlink to redirect the write to any file the dool process can access - an impact that escalates from trivial to severe if dool runs under elevated privileges such as root. No public exploit code or CISA KEV active exploitation is identified; the issue was reported by CERT-PL and addressed upstream via pull request #116.
CSV injection in Dool through version 1.3.8 allows a local attacker who can control process names on a monitored host to plant malicious spreadsheet formulas into CSV exports. When an administrator or analyst opens the exported file in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, the injected formula executes in that application's context. Reported by CERT-PL and tracked as EUVD-2026-67128, the issue has an upstream fix via GitHub PR #117, though no officially tagged release containing the patch has been independently confirmed. No public exploit code or CISA KEV listing is identified at time of analysis.
Symlink following in Dool (versions up to and including 1.3.8) allows a local attacker to cause arbitrary file truncation and overwriting when the tool is run with the non-default '--devel' flag. The vulnerable code path opens a log file without the O_NOFOLLOW flag (CWE-59), allowing a pre-placed symlink to redirect the write to any file the dool process can access - an impact that escalates from trivial to severe if dool runs under elevated privileges such as root. No public exploit code or CISA KEV active exploitation is identified; the issue was reported by CERT-PL and addressed upstream via pull request #116.
CSV injection in Dool through version 1.3.8 allows a local attacker who can control process names on a monitored host to plant malicious spreadsheet formulas into CSV exports. When an administrator or analyst opens the exported file in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, the injected formula executes in that application's context. Reported by CERT-PL and tracked as EUVD-2026-67128, the issue has an upstream fix via GitHub PR #117, though no officially tagged release containing the patch has been independently confirmed. No public exploit code or CISA KEV listing is identified at time of analysis.