CVE-2026-64955: CWE-1236 Improper neutralization of formula elements in a CSV file in Rapid7 Velociraptor
When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not clear if the vulnerability is actually in Microsoft Excel treating a CSV data file as executable content, or if Velociraptor should be sanitizing the data to prevent Excel from executing it. However, since this is such a common use case for Velociraptor we decided to highlight it in an advisory.
AI Analysis
Technical Summary
CVE-2026-64955 describes a vulnerability in Rapid7 Velociraptor where CSV files exported from the product (via GUI, offline collector, or data exports) contain cells that begin with characters interpreted by Microsoft Excel as formulas. Velociraptor fails to sanitize these cells, enabling Excel to execute them as formulas upon import. The root cause is the improper neutralization of formula elements (CWE-1236) in CSV files. It is unclear whether the flaw lies in Excel's handling of CSV files or Velociraptor's lack of sanitization, but the vulnerability is significant due to the common use of Velociraptor's CSV exports with Excel.
Potential Impact
An attacker could craft CSV data that, when exported by Velociraptor and opened in Microsoft Excel, executes arbitrary formulas. This can lead to arbitrary code execution within the context of Excel, potentially compromising the user's environment. The CVSS score of 6.1 (medium severity) reflects that the attack requires user interaction (opening the CSV) and has high confidentiality impact but no integrity or availability impact.
Mitigation Recommendations
No official patch or remediation level is currently provided by the vendor. Users should be cautious when opening CSV files exported from Velociraptor in Microsoft Excel, especially from untrusted sources. Monitoring vendor advisories for updates or patches is recommended. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-64955: CWE-1236 Improper neutralization of formula elements in a CSV file in Rapid7 Velociraptor
Description
When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not clear if the vulnerability is actually in Microsoft Excel treating a CSV data file as executable content, or if Velociraptor should be sanitizing the data to prevent Excel from executing it. However, since this is such a common use case for Velociraptor we decided to highlight it in an advisory.
CVSS v3.1
Score 6.1medium
Affected software
Rapid7
Velociraptor
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-64955 describes a vulnerability in Rapid7 Velociraptor where CSV files exported from the product (via GUI, offline collector, or data exports) contain cells that begin with characters interpreted by Microsoft Excel as formulas. Velociraptor fails to sanitize these cells, enabling Excel to execute them as formulas upon import. The root cause is the improper neutralization of formula elements (CWE-1236) in CSV files. It is unclear whether the flaw lies in Excel's handling of CSV files or Velociraptor's lack of sanitization, but the vulnerability is significant due to the common use of Velociraptor's CSV exports with Excel.
Potential Impact
An attacker could craft CSV data that, when exported by Velociraptor and opened in Microsoft Excel, executes arbitrary formulas. This can lead to arbitrary code execution within the context of Excel, potentially compromising the user's environment. The CVSS score of 6.1 (medium severity) reflects that the attack requires user interaction (opening the CSV) and has high confidentiality impact but no integrity or availability impact.
Mitigation Recommendations
No official patch or remediation level is currently provided by the vendor. Users should be cautious when opening CSV files exported from Velociraptor in Microsoft Excel, especially from untrusted sources. Monitoring vendor advisories for updates or patches is recommended. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- rapid7
- Date Reserved
- 2026-07-21T08:32:47.510Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a7c46ebbf8831d5396148fb
Added to database: 08/12/2026, 10:11:55 UTC
Last enriched: 08/12/2026, 10:31:20 UTC
Last updated: 09/27/2026, 01:47:44 UTC
Views: 80
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.