Executive brief
Venueless, a platform for virtual events, is vulnerable to a security flaw where user-provided data is incorrectly handled during Excel report generation for administrators. An attacker could submit malicious data that, when exported to an Excel file and opened by an administrator, executes unauthorized commands or compromises the administrator's computer. This could lead to the theft of sensitive event data or unauthorized access to administrative accounts.
Technical details
A CSV/Formula Injection vulnerability exists in Venueless due to improper neutralization of input leaders (CWE-148) when generating Excel exports for administrators. Untrusted user-supplied data is passed verbatim into spreadsheet cells without escaping characters such as '=', '+', '-', or '@'. A remote attacker with low privileges can input malicious formulas that execute when an administrator downloads and opens the export in a spreadsheet application like Microsoft Excel. This can lead to information disclosure from the local environment or the spreadsheet itself. The issue is addressed in commit 0a35457f.
Affected products
- pretix Venueless < 0a35457f
Timeline
- 2026-06-22: disclosed
- 2026-06-22: advisory
- 2026-06-22: patched