CVE-2026-56652 in Dool
Summary
by MITRE • 08/27/2026
Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting with =, which injects malicious formulas into the CSV output that execute when a victim opens the file in a spreadsheet application. The issue was addressed by pull request #117
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in Dool versions up to 1.3.8 represents a classic instance of CSV injection, also known as formula injection or cell injection. This security flaw arises from the software's failure to properly sanitize user-supplied data before writing it into comma-separated values files. Specifically, when exporting system information such as process names, the application does not escape or neutralize characters that are interpreted as command initiators by spreadsheet applications like Microsoft Excel, LibreOffice Calc, or Google Sheets. The primary technical flaw lies in the lack of input validation for cell content beginning with special formula characters including equals signs, plus signs, minus signs, and at symbols. These characters serve as triggers for formula execution within modern spreadsheet software, allowing an attacker to embed malicious logic directly into what appears to be benign data fields.
From a threat modeling perspective, this vulnerability enables a local privilege escalation or arbitrary code execution scenario depending on the context of the victim's actions. A local attacker can exploit this by creating a process with a crafted name that starts with one of these dangerous characters. For example, naming a malicious executable or script as =cmd|/c calc.exe!A1 allows the formula to execute system commands when opened in Excel under certain configurations. The operational impact is significant because it relies on social engineering tactics where a victim must open the exported CSV file using spreadsheet software that supports macro execution and dynamic content rendering. Once opened, the injected formulas can trigger remote code execution, data exfiltration via HTTP requests, or other malicious activities defined by the attacker within the formula syntax.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (CSRF) specifically under the subcategory of CSV injection and is often associated with CWE-78 Improper Neutralization of Special Elements used in an OS Command where the command interpreter is a spreadsheet application rather than a shell. In terms of the MITRE ATT&CK framework, this technique falls under T1059 Command and Scripting Interpreter as well as T1204 User Execution which describes how attackers rely on victims to open malicious files. The attack vector requires local access initially but can lead to broader network compromise if combined with other vulnerabilities or misconfigurations that allow remote triggering of file exports.
Mitigation strategies for this vulnerability involve both immediate patching and long-term defensive coding practices. Users should upgrade Dool to version 1.3.9 or later where the issue has been addressed via pull request #117 which implements proper sanitization logic. Developers must ensure that all data written to CSV files is prefixed with a single quote character apostrophe to force spreadsheet applications to treat the content as plain text rather than executable formulas. Additionally, implementing strict input validation that rejects or escapes special characters like equals plus minus and at symbols before export can prevent injection attempts. Security awareness training for end-users regarding the risks of opening untrusted CSV files is also recommended to reduce the likelihood of successful exploitation through social engineering vectors.