Is CVE-2026-108579 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-108579?

CVE-2026-108579 has a CVSS v3 severity of MEDIUM (4.2).

Back

CVE-2026-108579

Description

OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK(...) matching a cohort, so exported cohort CSVs execute formulas that exfiltrate adjacent cell data.