CVE-2026-64955 describes a vulnerability in Rapid7 Velociraptor where CSV files exported from the product (via GUI, offline collector, or data exports) contain cells that begin with characters interpreted by Microsoft Excel as formulas. Velociraptor fails to sanitize these cells, enabling Excel to execute them as formulas upon import. The root cause is the improper neutralization of formula elements (CWE-1236) in CSV files. It is unclear whether the flaw lies in Excel's handling of CSV files or Velociraptor's lack of sanitization, but the vulnerability is significant due to the common use of Velociraptor's CSV exports with Excel.

An attacker could craft CSV data that, when exported by Velociraptor and opened in Microsoft Excel, executes arbitrary formulas. This can lead to arbitrary code execution within the context of Excel, potentially compromising the user's environment. The CVSS score of 6.1 (medium severity) reflects that the attack requires user interaction (opening the CSV) and has high confidentiality impact but no integrity or availability impact.

No official patch or remediation level is currently provided by the vendor. Users should be cautious when opening CSV files exported from Velociraptor in Microsoft Excel, especially from untrusted sources. Monitoring vendor advisories for updates or patches is recommended. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.