Executive brief
Observe, a data monitoring and observability platform, is vulnerable to a flaw in its log export feature. An attacker can send specially crafted web requests that include malicious spreadsheet formulas. When an administrator or analyst later exports these logs to a CSV file and opens it in a program like Microsoft Excel, the formulas can execute, potentially stealing sensitive data from the spreadsheet or the user's computer.
Technical details
A CSV injection (Formula Injection) vulnerability exists in Observe v.2026-01-28 and earlier. The application fails to sanitize user-controlled HTTP request parameters (such as User-Agent or custom headers) before storing them in logs. An unauthenticated remote attacker can inject malicious formulas (e.g., =WEBSERVICE, =HYPERLINK, or DDE payloads) into these parameters. When a privileged user exports these logs to a CSV file and opens it in a spreadsheet application, the formula executes. This can lead to the exfiltration of other data within the spreadsheet, external file downloads, or remote code execution depending on the spreadsheet software's configuration.
Affected products
- Observeinc Observe v.2026-01-28 and earlier
Timeline
- 2026-02-03: disclosed: Vulnerability discovered and vendor notified
- 2026-06-09: advisory: Public disclosure by researcher
- 2026-06-15: other: CVE published to NVD