{"id":"CVE-2026-86020","kind":"vulnerability","aliases":["CVE-2026-86020"],"related":[],"title":"Part-DB: XLSX export writes imported formulas, executing them in spreadsheets","description":"Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet's setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2.","summary":"Part-DB writes attacker-supplied part fields into XLSX exports without neutralising leading formula characters, so an imported value like =1+1 becomes a live formula cell. When another user exports the parts and opens the spreadsheet, their spreadsheet software may evaluate the formula.","severity":"medium","cvss":4.6,"epss":0.00119,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["part-db","php","runtime","self-hosted","spreadsheet-export"],"not_affected_if":["default-config","no-untrusted-importers"],"how_to_check":"- Check the Part-DB version in the installed app; versions before `2.13.2` are affected.\n- Review who holds the permission to import parts, since that is the only way to plant a formula.","fix":"- Upgrade Part-DB to `2.13.2` or later.\n- Until upgraded, restrict part import permissions to trusted users only.","status":"open","published_at":"2026-10-23T05:17:18+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:35:20+00:00","updated_at":"2026-10-25T04:35:20+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T04:35:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Part-DB to `2.13.2` or later.\n- Until upgraded, restrict part import permissions to trusted users only.","reach":"internet","title":"Part-DB: XLSX export writes imported formulas, executing them in spreadsheets","impact":"low","summary":"Part-DB writes attacker-supplied part fields into XLSX exports without neutralising leading formula characters, so an imported value like =1+1 becomes a live formula cell. When another user exports the parts and opens the spreadsheet, their spreadsheet software may evaluate the formula.","category":"runtime","nicknames":[],"who_cares":["part-db","self-hosted","php","spreadsheet-export"],"confidence":0.7,"needs_auth":"yes","worst_case":"Spreadsheet formulas evaluate on another user's machine when they open an export","analyst_note":"","how_to_check":"- Check the Part-DB version in the installed app; versions before `2.13.2` are affected.\n- Review who holds the permission to import parts, since that is the only way to plant a formula.","needs_analyst":false,"not_affected_if":["default-config","no-untrusted-importers"],"who_is_affected":"Teams running self-hosted Part-DB before 2.13.2 where some users can import parts from CSV and others export those parts to XLSX. Instances where only trusted administrators import data, or that do not use XLSX export, carry much less risk.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000613,"input_tokens":3512,"output_tokens":524,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'+1':53B,128C '-2026':14A,17A '-86020':15A,18A '1':52B,127C '2.13.2':92C,208C 'affect':137C 'anoth':60B,185C 'attack':35B,152C 'attacker-control':151C 'attacker-suppli':34B 'authent':108C 'becom':54B 'cell':58B,177C 'charact':46B,164C 'compon':88C 'contain':96C,120C,172C 'control':132C,153C 'csv':118C 'cve':13A,16A 'db':3A,21B,32B,78C,95C,148C 'electron':87C 'evalu':73B,196C 'execut':9A,174C 'export':5A,29B,41B,62B,141C,169C,187C 'field':38B,134C 'file':119C,171C 'formula':8A,45B,57B,75B,99C,122C,163C,176C,193C 'formula-prefix':121C 'host':26B 'import':7A,49B,113C,116C 'import/export':105C 'inject':100C 'inventori':83C 'issu':202C 'later':140C 'lead':44B 'like':51B 'live':56B 'manag':84C 'may':72B,194C 'method':159C 'neutralis':43B,161C 'open':66B,81C,189C 'part':2A,20B,31B,37B,64B,77C,94C,104C,114C,133C,138C,147C 'part-db':1A,19B,30B,76C,93C,146C 'patch':205C 'permiss':111C 'php':22B 'phpspreadsheet':156C 'plain':181C 'prefix':123C 'prior':89C 'rather':178C 'result':167C 'runtim':23B 'self':25B 'self-host':24B 'setcellvalu':158C 'softwar':71B,200C 'sourc':82C 'spreadsheet':12A,28B,68B,70B,98C,145C,162C,175C,191C,199C 'spreadsheet-export':27B 'suppli':36B 'system':85C 'text':182C 'use':155C 'user':61B,109C,131C,186C 'user-control':130C 'valu':50B,124C,154C,183C 'version':91C,207C 'vulner':101C 'without':42B,160C 'workflow':106C 'write':6A,33B,149C 'xlsx':4A,40B,144C,170C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Part-DB before 2.13.2 where some users can import parts from CSV and others export those parts to XLSX. Instances where only trusted administrators import data, or that do not use XLSX export, carry much less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T05:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86020","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86020","severity":null,"published_at":"2026-10-23T05:17:18+00:00","modified_at":"2026-10-23T19:36:32+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-86020","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86020","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}