LOW 2.3 NVD
CVE-2026-108579
OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted
OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK(...) matching a cohort, so exported cohort CSVs execute formulas that exfiltrate adjacent cell data.
References
- https://github.com/Openpanel-dev/openpanel
- https://github.com/Openpanel-dev/openpanel/blob/7c4d22ae4b6b20fb08eb5c94a0cd3cfebb3d32ca/a
- https://hackmd.io/@haind/openpanel-cohort-csv-formula-injection
- https://www.vulncheck.com/advisories/openpanel-through-2.3.0-csv-formula-injection-via-coh
This low severity vulnerability with a CVSS score of 2.3 was published on 2026-10-10 via NVD.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.