TI-2026-70567 Aliases CVE-2026-108579 GHSA-qhg3-x2wc-w8x2

CSV formula injection in OpenPanel cohort member export

LOW 11CWE-1236Published 2026-10-10 · Updated 2026-10-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

OpenPanel through 2.3.0 contains a CSV formula injection flaw (CWE-1236) in its cohort member export. An unauthenticated remote attacker can send tracking events to the /track endpoint with crafted profile IDs that match a cohort. When a user opens the exported cohort CSV, the spreadsheet runs the embedded formulas, which can exfiltrate data from adjacent cells.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK(...) matching a cohort, so exported cohort CSVs execute formulas that exfiltrate adjacent cell data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00196 9th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Openpanel-dev	openpanel	up to 2.3.0	—	No fix listed	CNA

openpanel VendorOpenpanel-dev Affected up to 2.3.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for OpenPanel.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-11 Threatist record created from CVE-2026-108579
2026-10-11 Alias added: GHSA-qhg3-x2wc-w8x2
2026-10-14 CISA SSVC decision points changed

References

Advisory 1

https://hackmd.io/@haind/openpanel-cohort-csv-formula-injection

Other 2

TI-2026-63244 OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE CVSS 4.0CRITICAL 9.4
TI-2026-80976 Sandbox escape in OpenPanel webhook JavaScript templates allows code execution CVSS 4.0HIGH 8.7
TI-2026-80973 SQL injection in OpenPanel ClickHouse query lets users read other tenants' data CVSS 4.0HIGH 8.6
TI-2026-80981 Missing authentication in OpenPanel Bull Board worker dashboard CVSS 4.0MEDIUM 6.9
TI-2026-80975 Missing authorization in OpenPanel exposes project chart annotations CVSS 4.0MEDIUM 6.9
TI-2026-63243 OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret CVSS 4.0MEDIUM 6.9

See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences