CVE-2026-64955: Velociraptor CSV Formula Injection RCE

CVE-2026-64955 Overview

CVE-2026-64955 is a CSV injection vulnerability affecting Velociraptor, a digital forensics and incident response (DFIR) platform. Velociraptor fails to sanitize cell contents when exporting data to CSV files from the GUI, offline collector, or data export functions. When Microsoft Excel opens the resulting CSV, cells beginning with characters such as =, +, -, or @ are interpreted as formulas and executed. An attacker who can influence data collected by Velociraptor can craft malicious cell contents that trigger arbitrary formula execution in Excel when an analyst opens the export. This class of issue is tracked under [CWE-1236: Improper Neutralization of Formula Elements in a CSV File].

Critical Impact
Analysts opening Velociraptor CSV exports in Excel may unknowingly execute attacker-controlled formulas, enabling data exfiltration or command execution on the analyst workstation.

Affected Products

Velociraptor DFIR platform (CSV export functionality)
Velociraptor GUI data exports
Velociraptor offline collector output

Discovery Timeline

2026-08-12 - CVE-2026-64955 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-64955

Vulnerability Analysis

The vulnerability arises from unsanitized data flowing into CSV export files produced by Velociraptor. Velociraptor collects artifacts and telemetry from endpoints during investigations, then permits analysts to export results as CSV for reporting or further analysis. When an artifact field contains attacker-controlled text beginning with a formula trigger character, that content is written verbatim into the CSV cell.

When an analyst subsequently opens the CSV in Microsoft Excel, Excel treats those cells as formulas rather than literal strings. This allows execution of Excel functions such as HYPERLINK, WEBSERVICE, or DDE invocations that can exfiltrate data or launch external commands. The attack requires user interaction and typically requires the analyst to acknowledge Excel security prompts, which reduces reliability.

Root Cause

The root cause is missing output encoding in Velociraptor's CSV serialization logic. The exporter does not prefix untrusted cell values that begin with =, +, -, @, tab, or carriage return with a neutralizing character such as a single quote. Whether the defect lies with Velociraptor's export sanitization or with Excel's default handling of CSV is debated, but Velociraptor's advisory addresses the issue as a data-hygiene problem in its exporter.

Attack Vector

An attacker first plants malicious content on a system that Velociraptor will later collect from, for example within file metadata, log entries, process command lines, or registry values that the DFIR team is likely to query. When responders run a hunt or artifact collection, the attacker's payload is captured. When results are exported to CSV and opened in Excel, the formula executes in the analyst's context. The scope-change component of the CVSS vector reflects that exploitation moves from the target endpoint to the analyst workstation.

Detection Methods for CVE-2026-64955

Indicators of Compromise

Cells within Velociraptor CSV exports beginning with =, +, -, or @ followed by Excel function names such as HYPERLINK(, WEBSERVICE(, IMPORTDATA(, or cmd|.
Outbound network connections from analyst workstations to unexpected hosts shortly after opening a Velociraptor CSV export.
Excel spawning child processes such as cmd.exe, powershell.exe, or rundll32.exe on DFIR analyst systems.

Detection Strategies

Scan Velociraptor CSV export files for cells whose first character matches the formula trigger set before distributing them to analysts.
Monitor process telemetry on analyst workstations for excel.exe parent-child relationships that indicate DDE or formula-driven command execution.
Alert on unusual DNS or HTTP requests originating from Office processes on responder endpoints.

Monitoring Recommendations

Log every Velociraptor artifact collection and export event, correlating exports with the analyst who opened them.
Enable Microsoft Office attack surface reduction (ASR) rules that block Office applications from creating child processes and forward the telemetry to a central SIEM.
Track file access patterns for CSV files produced by DFIR tooling and flag opens in Excel on hosts outside a hardened analysis VLAN.

How to Mitigate CVE-2026-64955

Immediate Actions Required

Update Velociraptor to the fixed release referenced in the Velociraptor Security Advisory.
Instruct analysts to open Velociraptor CSV exports in a text editor or import them via Excel's Data Import wizard with all columns set to Text.
Disable Dynamic Data Exchange (DDE) in Microsoft Excel across analyst workstations.

Patch Information

Refer to the Velociraptor Security Advisory for the fixed version and release notes describing the CSV sanitization changes. The vendor's fix prefixes untrusted cell values beginning with formula trigger characters so Excel treats them as literal strings.

Workarounds

Convert CSV exports to XLSX using a tool that writes cell values as strings before distribution.
Preprocess CSV exports with a script that prepends a single quote to any cell starting with =, +, -, @, tab, or carriage return.
Restrict opening of DFIR data exports to isolated analysis virtual machines with no outbound network access.

bash

# Configuration example: sanitize a Velociraptor CSV export prior to opening in Excel
awk 'BEGIN{FS=OFS=","} {for(i=1;i<=NF;i++){c=substr($i,1,1); if(c=="="||c=="+"||c=="-"||c=="@"){$i="'\''" $i}} print}' export.csv > export.sanitized.csv