Is CVE-2026-12862 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12862 being exploited in the wild.

How severe is CVE-2026-12862?

Informational severity, with a CVSS score of 5.1, published 22 June 2026.

Is there a fix for CVE-2026-12862?

A patch was published on 2026-06-22. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12862 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-12862?

Check whether you run Pretix Venueless at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12862: Pretix Venueless formula injection in Excel exports

CVE-2026-12862 · Severity: info · CVSS 5.1 · Published 2026-06-22

Venueless, a platform for virtual events, is vulnerable to a security flaw where user-provided data is incorrectly handled during Excel report generation for administrators. An attacker could submit malicious data that, when exported to an Excel file and opened by an administrator, executes unauthorized commands or compromises the administrator's computer. This could lead to the theft of sensitive event data or unauthorized access to administrative accounts.

Technologies: Pretix Venueless. Vendors: Pretix.

Quick answers

Is CVE-2026-12862 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12862 being exploited in the wild.
How severe is CVE-2026-12862?: Informational severity, with a CVSS score of 5.1, published 22 June 2026.
Which products and versions are affected?: Pretix Venueless < 0a35457f.
Is there a fix for CVE-2026-12862?: A patch was published on 2026-06-22. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12862 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-12862?: Check whether you run Pretix Venueless at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A CSV/Formula Injection vulnerability exists in Venueless due to improper neutralization of input leaders (CWE-148) when generating Excel exports for administrators. Untrusted user-supplied data is passed verbatim into spreadsheet cells without escaping characters such as '=', '+', '-', or '@'. A remote attacker with low privileges can input malicious formulas that execute when an administrator downloads and opens the export in a spreadsheet application like Microsoft Excel. This can lead to information disclosure from the local environment or the spreadsheet itself. The issue is addressed in commit 0a35457f.

Affected products

pretix Venueless < 0a35457f

Timeline

2026-06-22: disclosed
2026-06-22: advisory
2026-06-22: patched

References

https://github.com/venueless/venueless/security/advisories/GHSA-5hw3-655h-7m86

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.