CVE-2026-12862

Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file.

CVSS

No CVSS.

References

Link	Resource
https://github.com/venueless/venueless/security/advisories/GHSA-5hw3-655h-7m86

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Datos de usuario no confiables se pasaron textualmente a las exportaciones de Excel para los administradores. Esto permitió la inyección de fórmulas que puede usarse para comprometer el entorno del usuario que carga el archivo o otros datos en el archivo.

Information

Published : 2026-06-22 10:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-12862

Mitre link : CVE-2026-12862

CVE.ORG link : CVE-2026-12862

JSON object : View

Products Affected

No product.

CWE

CWE-148

Improper Neutralization of Input Leaders

{"id": "CVE-2026-12862", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12862", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T12:23:08.251405Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "affectedData": [{"vendor": "pretix", "product": "Venueless", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "0a35457f", "versionType": "git"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-22T10:16:18.387", "references": [{"url": "https://github.com/venueless/venueless/security/advisories/GHSA-5hw3-655h-7m86", "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "description": [{"lang": "en", "value": "CWE-148"}]}], "descriptions": [{"lang": "en", "value": "Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file."}, {"lang": "es", "value": "Datos de usuario no confiables se pasaron textualmente a las exportaciones de Excel para los administradores. Esto permiti\u00f3 la inyecci\u00f3n de f\u00f3rmulas que puede usarse para comprometer el entorno del usuario que carga el archivo o otros datos en el archivo."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "655498c3-6ec5-4f0b-aea6-853b334d05a6"}