Description

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution.  Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not clear if the vulnerability is actually in Microsoft Excel treating a CSV data file as executable content, or if Velociraptor should be sanitizing the data to prevent Excel from executing it. However, since this is such a common use case for Velociraptor we decided to highlight it in an advisory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-12T10:17:20.310Z",
  "pubdate": "2026-08-12T10:17:20.310Z",
  "executiveSummary": "This advisory highlights a vulnerability in Velociraptor where data exported to CSV formats fails to sanitize cell contents properly. Specifically, when Microsoft Excel processes CSV files containing cells beginning with certain characters, it automatically interprets and executes them as formulas.\nThe affected product is Velociraptor across its various export vectors, including the graphical user interface (GUI), offline collectors, and general data export mechanisms. The primary vulnerability type is CSV Injection, also known as Formula Injection.\nThe impact of this vulnerability involves arbitrary execution within the context of the user opening the exported CSV file in Microsoft Excel. Although the behavior is fundamentally driven by how Microsoft Excel treats CSV data files as executable content, the failure of Velociraptor to sanitize exported data creates significant risk for analysts and administrators handling forensic exports.\nAn attacker capable of injecting malicious formulas into data sources queried or parsed by Velociraptor can leverage this vector to achieve execution when the resulting data is exported and reviewed in spreadsheet applications. Exploitation requires an authenticated user to export the data and subsequently open the generated CSV file using a vulnerable spreadsheet processor like Microsoft Excel.",
  "technicalDetails": "The root cause of the vulnerability lies in the lack of input sanitization and output encoding within Velociraptor export routines. When Velociraptor generates CSV exports from various locations—such as the GUI, offline collectors, and data export functions—it writes raw string data directly into the CSV cells without stripping or escaping prefix characters that trigger formula evaluation.\nSpreadsheet applications such as Microsoft Excel automatically parse cells starting with specific characters, notably the equals sign (=), plus sign (+), minus sign (-), and at symbol (@), as executable formulas rather than static text strings. Consequently, if an endpoint, artifact, or log processed by Velociraptor contains maliciously crafted text starting with these designated characters, that text is preserved verbatim in the generated CSV output.\nThe attack flow proceeds as follows: First, malicious data containing formula payloads (such as DDE commands or external data requests) is introduced into a target environment where Velociraptor collects artifacts. Second, an operator initiates an export operation via the Velociraptor GUI, offline collector, or data export utility, generating a CSV file containing the unsanitized payload. Third, the operator opens the exported CSV file in Microsoft Excel. Fourth, Excel parses the cell containing the malicious prefix as a formula and executes it.\nThe vulnerable components include the CSV generation and data export subsystems of Velociraptor. The vulnerability manifests locally during the file consumption phase, though the payload origin may stem from remote endpoints or collected artifacts. Authentication and privilege requirements depend on the specific Velociraptor interface used to trigger the export, but typically require access to export data from the platform. Network exposure is not strictly required for the local execution phase, as the vulnerability is triggered upon opening the static CSV file within a spreadsheet application."
}