CVE-2026-12862 describes a vulnerability in pretix Venueless where untrusted user data is included verbatim in Excel export files without proper sanitization. This allows an attacker to inject malicious formulas into the exported spreadsheet, which may execute when opened by an administrator, potentially compromising their environment or other data within the file. The vulnerability is categorized as CWE-148, relating to improper neutralization of input leaders in data exported to Excel. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on confidentiality and integrity.

Successful exploitation allows an attacker to perform formula injection in Excel files generated by pretix Venueless, potentially leading to compromise of the administrator's environment or manipulation of data within the file. The impact is limited to users who open the maliciously crafted exported Excel files. There is no indication of remote code execution beyond the spreadsheet context or broader system compromise from the provided data.

No official patch or remediation level is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when opening Excel exports from untrusted sources and consider sanitizing input data before export if possible.