Executive brief
Dool is a system resource monitoring tool that generates performance reports. Versions up to 1.3.8 fail to sanitize process names when exporting data to CSV files, allowing an attacker with local access to inject malicious formulas that execute when a victim opens the CSV in Excel or other spreadsheet software. This could lead to command execution or data theft depending on the spreadsheet application's capabilities.
Technical details
This is a CSV injection vulnerability (CWE-1236) where the application fails to neutralize formula characters (=, +, -, @) in cell content. An attacker can create a local process with a crafted name beginning with a formula character (e.g., "=cmd|'/c calc'!A1"); when dool exports this process data to CSV, the unsanitized name becomes an executable formula. The vulnerability requires local access to run a malicious process on the target system. When a victim opens the exported CSV in a formula-enabled spreadsheet application, the injected formula executes with the victim's privileges. The fix was provided in pull request #117.
Affected products
- Scott Baker dool up to 1.3.8
Timeline
- 2026-08-27: disclosed
- 2026-06-18: patched: Pull request #117 merged