---
id: "CVE-2026-86020"
kind: "vulnerability"
aliases: ["CVE-2026-86020"]
title: "Part-DB: XLSX export writes imported formulas, executing them in spreadsheets"
severity: "medium"
cvss: 4.6
epss: 0.00119
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["part-db", "php", "runtime", "self-hosted", "spreadsheet-export"]
not_affected_if: ["default-config", "no-untrusted-importers"]
published_at: "2026-10-23T05:17:18+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T04:35:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86020", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-86020", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Part-DB: XLSX export writes imported formulas, executing them in spreadsheets

Part-DB writes attacker-supplied part fields into XLSX exports without neutralising leading formula characters, so an imported value like =1+1 becomes a live formula cell. When another user exports the parts and opens the spreadsheet, their spreadsheet software may evaluate the formula.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Part-DB version in the installed app; versions before `2.13.2` are affected.
- Review who holds the permission to import parts, since that is the only way to plant a formula.

## Fix

- Upgrade Part-DB to `2.13.2` or later.
- Until upgraded, restrict part import permissions to trusted users only.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86020
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-86020

## From the sources

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet's setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_