Loading story…
TypeBot disclosed CVE-2026-47705, a high-severity CSV injection flaw in version 3.16.1 that allowed attacker-controlled input in exported results to be written to CSV files without proper sanitization or escaping. If an administrator opened a malicious export in spreadsheet software such as Microsoft Excel or LibreOffice Calc, injected formulas could execute, potentially leading to compromise of confidentiality, integrity, and availability. The issue is tracked as CWE-1236 and carries the CVSS v3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
The vulnerability was fixed in TypeBot 3.17.0 through changes merged into the main branch in pull request #2493, titled "Sanitize CSV exports against formula injection." The patch introduced or updated a sanitizeCsvCell routine and modified export-related components including streamAllResultsToCsv, streamAllResultsToCsvV2, SelectionToolbar, and ExportAllResultsDialog, indicating the remediation focused on preventing spreadsheet formula payloads from being preserved in exported result files.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE entry states the vulnerability was newly received by security-advisories@github.com as CVE-2026-47705. The issue describes a CSV injection flaw in TypeBot 3.16.1's result export feature.
Baptiste Arnaud merged pull request #2493 and commit 89682dd into the main branch to sanitize CSV exports against formula injection in TypeBot's result export functionality. The change introduced or modified sanitization logic for dangerous spreadsheet-leading characters and affected export-related components.
CVE-2026-47705 was disclosed as a CSV injection vulnerability affecting TypeBot 3.16.1, where unsanitized user input in exported CSV files could execute formulas when opened in spreadsheet software. The advisory states that TypeBot version 3.17.0 fixes the issue and references the related GitHub advisory, fixing commit, pull request, and release tag.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Flowise disclosed and fixed **`CVE-2026-69255`**, a high-severity remote code execution flaw in the `CSVAgent` component affecting versions earlier than **3.1.3**. The bug stemmed from attacker-controlled CSV content being inserted directly into executable Python before being passed to **Pyodide**, allowing code injection. Because Flowise validated only later LLM-generated code and not the initial Python block, an attacker could escape the intended string context, pivot through Pyodide's JavaScript bridge, reach Node.js `child_process`, and execute arbitrary operating system commands as **root** inside the Flowise container. A related Flowise GitHub commit shows the vendor removed both **`CSVAgent`** and **`AirtableAgent`** and deleted Python code validation functionality as part of the security response. The change also removed the `pyodide` dependency and deleted more than 1,600 lines of code, indicating a broad rollback of the affected feature set rather than a narrow patch. The vulnerability is tracked as **CWE-94** and is addressed in **Flowise 3.1.3**.
Aug 5, 2026
Microsoft disclosed **`CVE-2026-62870`**, a high-severity remote code execution vulnerability in **Microsoft Excel** caused by a use-after-free flaw. The bug carries a **CVSS v3.1 score of 8.8** and affects **Microsoft 365 Apps for Enterprise**, **Excel 2016**, **Office 2019**, **Office LTSC 2021**, and **Office LTSC 2024** on both **32-bit** and **x64-based** systems. According to the advisory, an unauthenticated attacker could exploit the flaw over a network by delivering a specially crafted Excel file and executing code in the context of the current user. Microsoft released security updates addressing the issue, and reporting indicates exploitation requires **user interaction** to open the malicious file. Successful compromise could let attackers install malware, steal data, and pivot further into enterprise environments depending on the victim's privileges. At the time of publication, there was **no public exploit** and **no confirmed active exploitation**, and the vulnerability had **not** been added to **CISA's Known Exploited Vulnerabilities catalog**.
Aug 4, 2026
Microsoft published guidance for **CVE-2026-26144**, a **Critical** *Microsoft Excel* **information disclosure** vulnerability tracked in the Microsoft Security Update Guide. Microsoft maps the issue to **CWE-79** (improper neutralization of input during web page generation / XSS) and provides CVSS v3.1 scoring indicating network-reachable exploitation conditions with high confidentiality impact (vector `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`). The advisory is available via MSRC’s Update Guide endpoints (including RSS, PowerShell, API, and CSAF links) to support patch/vulnerability management workflows. No additional incident context, exploitation details, or third-party reporting is included in the provided material beyond the MSRC advisory metadata and scoring.
Jul 12, 2026