CVE-2026-23873 identifies a CSV Injection vulnerability in the open-source online judge system hustoj, which is widely used for ACM/ICPC and NOIP training. The vulnerability is due to improper neutralization of formula elements (CWE-1236) in CSV files generated by the contest rank export functionalities (contestrank.xls.php and admin/ranklist_export.php). Specifically, the application fails to sanitize the 'Nickname' field input from users before embedding it into an .xls file that is rendered as an HTML table but opened by Microsoft Excel. If a malicious user sets their nickname to a string starting with an Excel formula (e.g., =CMD|'/C calc'!A0), when an administrator exports and opens the rank list, Excel will interpret and execute the formula. This can lead to arbitrary command execution (RCE) on the administrator’s machine or data exfiltration, posing a significant risk to confidentiality and integrity. The vulnerability requires low privileges for the attacker but does require user interaction (opening the file) and some privileges for the victim (administrator). No official patch or fix is available at the time of publication, increasing the risk for organizations relying on this software. The CVSS 4.0 score is 5.2 (medium), reflecting the moderate impact and exploitation complexity.

For European organizations, especially educational institutions, competitive programming platforms, and training centers using hustoj, this vulnerability poses a risk of remote code execution on administrative machines. Successful exploitation could lead to unauthorized access to sensitive data, lateral movement within networks, or disruption of contest operations. Since the attack vector involves exporting and opening rank lists, it targets administrative users who may have elevated privileges, increasing potential damage. The lack of a patch means organizations must rely on mitigations to prevent exploitation. The impact on confidentiality and integrity is significant if exploited, and availability could also be affected if malicious commands disrupt systems. Given the widespread use of Microsoft Excel in Europe and the popularity of hustoj in programming education, the threat is relevant and should be addressed promptly.

1. Implement input sanitization on the 'Nickname' field to neutralize any formula characters (e.g., prefixing with a single quote or removing leading '=' characters) before exporting to Excel files. 2. Restrict the export functionality to highly trusted users or administrators only, minimizing exposure. 3. Educate administrators to disable automatic formula execution in Excel by enabling the 'Disable automatic links' or 'Disable external content' settings. 4. Use alternative export formats that do not interpret formulas, such as plain CSV with proper escaping or PDF exports. 5. Monitor and audit exported files for suspicious content before opening. 6. Consider sandboxing or opening exported files in isolated environments to limit potential damage. 7. Engage with the hustoj community or maintainers to prioritize development of an official patch. 8. Regularly update and patch related software components and maintain strong endpoint protection on administrative machines.