Spreadsheet Formula Injection Vulnerability in Part-DB by Part-DB

CVE-2026-86020

What is CVE-2026-86020?

Part-DB, an open-source inventory management system for electronic components, was found to have a spreadsheet formula injection vulnerability in its part import/export workflow prior to version 2.13.2. This vulnerability allows authenticated users to import CSV files with formula-prefixed values into user-controlled part fields. When exported as an XLSX spreadsheet, the attacker-controlled values are preserved, enabling the execution of arbitrary formulas in the resulting spreadsheet. This can pose significant risks if the exported file is opened by another user, as their spreadsheet software may evaluate the malicious formulas. This vulnerability has been addressed in the latest release, version 2.13.2.

References