Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-56652

Formula Injection in dool project

Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting with =, which injects malicious formulas into the CSV output that execute when a victim opens the file in a spreadsheet application.  The issue was addressed by pull request #117

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Scottchiefbaker
Products
Dool
CVE-2026-56651

Arbitrary File Overwrite via Symlink Following in dool project

Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without the "O_NOFOLLOW" flag. A local attacker can exploit this by creating a symlink at the expected log file path pointing to a sensitive file, causing dool to truncate and overwrite the target file with log data, which is especially impactful if dool is run with elevated privileges. The issue was addressed by pull request #116

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Scottchiefbaker
Products
Dool