CyberRota Analysis
AI-GeneratedDool versions up to 1.3.8 are susceptible to a CSV injection vulnerability due to inadequate sanitization of cell content when exporting data to CSV files. This flaw allows local attackers to craft malicious filenames that, when executed in a spreadsheet application, can run harmful formulas, potentially compromising user data. Organizations using Dool should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting with =, which injects malicious formulas into the CSV output that execute when a victim opens the file in a spreadsheet application. The issue was addressed by pull request #117