Read the docs
TI-2026-79545 Aliases CVE-2026-86020

Spreadsheet formula injection in Part-DB XLSX part exports

Priority LOW 20CWE-1236Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Part-DB-server versions before 2.13.2 are affected. Part-DB does not neutralise formula-prefixed values such as =1+1 that are imported from CSV files into part fields, so they are written to XLSX exports as executable formula cells (CWE-1236). An authenticated user with permission to import parts can plant such values, and another user who exports and opens the spreadsheet may have the formula evaluated by their spreadsheet software.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet's setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00155 4th percentileScored 2026-11-07
Fix Fixed Part-DB-server (Part-DB): 2.13.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Part-DBPart-DB-serverbefore 2.13.22.13.2Patch availableCNA
  • Part-DB-server VendorPart-DB Affected before 2.13.2 Fixed in 2.13.2 Patch available CNA

Remediation

Upgrade Part-DB-server to version 2.13.2 or later, which contains the patch.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Part-DB-server (Part-DB) Fixed in 2.13.2

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-86020
  2. 2026-10-23 CISA SSVC decision points changed

References

Other 2

  • TI-2026-79546 Password reset link poisoning in Part-DB allows account takeover CVSS 4.0HIGH 8.7
  • TI-2019-15485 Part-DB 0.4 Authentication Bypass via login.php CVSS 4.0HIGH 8.8
  • TI-2026-79538 Part-DB attachment upload allows PHP execution via .phar files CVSS 3.1CRITICAL 9.6
  • TI-2022-00754 OS Command Injection in part-db/part-db CVSS 3.1CRITICAL 9.8
  • TI-2026-79539 Hardcoded APP_SECRET in Part-DB enables forged login cookies CVSS 3.1MEDIUM 6.3
  • TI-2026-79540 Stored HTML injection in Part-DB BOM validation results CVSS 4.0MEDIUM 5.7
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences