What’s Vulnerable › Vulnerabilities
CVE-2026-12862: XLSX formula injection in exports
- Severity: medium (CVSS 5.1 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-22 · updated 2026-10-25
- Weakness: CWE-148
Description
Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file.
References
Get alerted when CVE-2026-12862 or the next vulnerability affects your stack