Vulnerability · Published Oct 23, 2026 · Assigned by GitHub_M

CVE-2026-86020Part-DB: Spreadsheet Formula Injection in XLSX Part Exports

Medium 4.6

In plain English

A medium-severity improper input validation in Part-DB-server from Part-DB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)4.6Medium

Exploit odds (30 days)0.2%top 95.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet's setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2.

Affected products (as reported)

Vendor	Product	Versions
Part-DB	Part-DB-server	< 2.13.2

Weakness: CWE-20, CWE-1236 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-hxw4-frfg-f8jw x_refsource_CONFIRM
https://github.com/Part-DB/Part-DB-server/releases/tag/v2.13.2 x_refsource_MISC