CVE-2026-23873

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23873", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-16T21:02:02.899Z", "datePublished": "2026-01-21T23:26:21.924Z", "dateUpdated": "2026-01-22T21:54:23.320Z"}, "containers": {"cna": {"title": "HUSTOJ is Vulnerable to Stored CSV Injection (Formula Injection) in Contest Rank Export", "problemTypes": [{"descriptions": [{"cweId": "CWE-1236", "lang": "en", "description": "CWE-1236: Improper Neutralization of Formula Elements in a CSV File", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 5.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H", "version": "4.0"}}], "references": [{"name": "https://github.com/zhblue/hustoj/security/advisories/GHSA-gqwv-v7vx-2qjw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/zhblue/hustoj/security/advisories/GHSA-gqwv-v7vx-2qjw"}], "affected": [{"vendor": "zhblue", "product": "hustoj", "versions": [{"version": "<= 26.01.01", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T23:26:21.924Z"}, "descriptions": [{"lang": "en", "value": "hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Injection) through the contest rank export functionality (contestrank.xls.php and admin/ranklist_export.php). The application fails to sanitize user-supplied input (specifically the \"Nickname\" field) before exporting it to an .xls file (which renders as an HTML table but is opened by Excel). If a malicious user sets their nickname to an Excel formula when an administrator exports and opens the rank list in Microsoft Excel, the formula will be executed. This can lead to arbitrary command execution (RCE) on the administrator's machine or data exfiltration. A fix was not available at the time of publication."}], "source": {"advisory": "GHSA-gqwv-v7vx-2qjw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T21:54:13.465092Z", "id": "CVE-2026-23873", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T21:54:23.320Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23873", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-22T21:54:13.465092Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T21:54:18.753Z"}}], "cna": {"title": "HUSTOJ is Vulnerable to Stored CSV Injection (Formula Injection) in Contest Rank Export", "source": {"advisory": "GHSA-gqwv-v7vx-2qjw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "zhblue", "product": "hustoj", "versions": [{"status": "affected", "version": "<= 26.01.01"}]}], "references": [{"url": "https://github.com/zhblue/hustoj/security/advisories/GHSA-gqwv-v7vx-2qjw", "name": "https://github.com/zhblue/hustoj/security/advisories/GHSA-gqwv-v7vx-2qjw", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Injection) through the contest rank export functionality (contestrank.xls.php and admin/ranklist_export.php). The application fails to sanitize user-supplied input (specifically the \"Nickname\" field) before exporting it to an .xls file (which renders as an HTML table but is opened by Excel). If a malicious user sets their nickname to an Excel formula when an administrator exports and opens the rank list in Microsoft Excel, the formula will be executed. This can lead to arbitrary command execution (RCE) on the administrator's machine or data exfiltration. A fix was not available at the time of publication."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1236", "description": "CWE-1236: Improper Neutralization of Formula Elements in a CSV File"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T23:26:21.924Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23873", "state": "PUBLISHED", "dateUpdated": "2026-01-22T21:54:23.320Z", "dateReserved": "2026-01-16T21:02:02.899Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-21T23:26:21.924Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "hustoj", "vendor": "zhblue", "versions": [{"status": "affected", "version": "<= 26.01.01"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hustoj:hustoj:*:*:*:*:*:*:*:*", "matchCriteriaId": "1AAF6021-2121-444F-A632-865C9524A033", "versionEndIncluding": "26.01.31", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Injection) through the contest rank export functionality (contestrank.xls.php and admin/ranklist_export.php). The application fails to sanitize user-supplied input (specifically the \"Nickname\" field) before exporting it to an .xls file (which renders as an HTML table but is opened by Excel). If a malicious user sets their nickname to an Excel formula when an administrator exports and opens the rank list in Microsoft Excel, the formula will be executed. This can lead to arbitrary command execution (RCE) on the administrator's machine or data exfiltration. A fix was not available at the time of publication."}, {"lang": "es", "value": "hustoj es un juez en l\u00ednea de c\u00f3digo abierto basado en PHP/C++/MySQL/Linux para el entrenamiento de ACM/ICPC y NOIP. Todas las versiones son vulnerables a la inyecci\u00f3n CSV (inyecci\u00f3n de f\u00f3rmulas) a trav\u00e9s de la funcionalidad de exportaci\u00f3n de clasificaci\u00f3n de concursos (contestrank.xls.php y admin/ranklist_export.php). La aplicaci\u00f3n no logra sanear la entrada proporcionada por el usuario (espec\u00edficamente el campo 'Nickname') antes de exportarla a un archivo .xls (que se renderiza como una tabla HTML pero es abierto por Excel). Si un usuario malicioso establece su apodo a una f\u00f3rmula de Excel cuando un administrador exporta y abre la lista de clasificaci\u00f3n en Microsoft Excel, la f\u00f3rmula ser\u00e1 ejecutada. Esto puede llevar a la ejecuci\u00f3n arbitraria de comandos (RCE) en la m\u00e1quina del administrador o a la exfiltraci\u00f3n de datos. Una soluci\u00f3n no estaba disponible en el momento de la publicaci\u00f3n."}], "id": "CVE-2026-23873", "lastModified": "2026-06-17T10:22:14.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.2, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23873", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T21:54:13.465092Z", "version": "2.0.3"}}]}, "published": "2026-01-22T00:15:51.770", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/zhblue/hustoj/security/advisories/GHSA-gqwv-v7vx-2qjw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1236"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T04:03:19.182438+00:00", "value": {"mitigation_remediation": ["Update to the latest HUSTOJ revision once a fix for the CSV injection issue is released.", "Apply input sanitization to the Nickname field, preferring a leading single quote to neutralize potential formulas before export.", "Restrict export privileges to trusted administrators and open exported .xls files in a sandboxed or read\u2011only environment to prevent execution of embedded formulas."], "summary": {"action": "Monitor", "impact": "Remote Command Execution"}, "threat_synthesis": {"affected_systems": "All versions of HUSTOJ developed by zhblue are affected. The vulnerability resides in the CSV export functionalities of the judging platform.", "description_and_impact": "An attacker can set the Nickname field of a user account to a malicious Excel formula. When an administrator exports the contest rank list via contestrank.xls.php or admin/ranklist_export.php, the application writes the Nickname into an .xls file without sanitization. Because Excel renders the .xls file as an HTML table and evaluates embedded formulas, the malicious formula is executed on the machine that opens the file, enabling arbitrary command execution or data exfiltration.", "risk_and_exploitability": "The CVSS base score is 5.2, indicating a moderate severity. EPSS is under 1%, showing a low current exploitation probability, and the vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires that an attacker gains the ability to set a malicious Nickname and that an administrator later export the rank list and open the generated file in Microsoft Excel. Thus, the vulnerability is a local execution vector that can compromise confidentiality, integrity, or availability if the administrator uses a vulnerable system to view exported data."}}}}, "created": "2026-01-22T10:08:47.809619+00:00", "updated": "2026-04-18T04:15:05.869973+00:00", "vendors": ["hustoj", "hustoj$PRODUCT$hustoj"]}