# CVE-2026-86742: Snipe-IT formula injection in asset acceptance report CSV export

Source: https://junglewise.ai/threats/cve-2026-86742-snipe-it-formula-injection-in-asset-acceptance-report-csv-export  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86742 · Severity: medium · CVSS 6.5 · Published 2026-09-09

Snipe-IT is an asset management platform used to track hardware and equipment inventory. A vulnerability in the CSV export feature of the unaccepted assets acceptance report allows attackers to inject malicious formulas into exported files. When a user with reporting permissions downloads and opens the CSV in Excel, LibreOffice Calc, or Google Sheets, the formulas can be executed to steal data or run arbitrary commands on the user's workstation.

Technologies: [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-86742 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86742 being exploited in the wild.

**How severe is CVE-2026-86742?** Medium severity, with a CVSS score of 6.5, published 9 September 2026.

**Which products and versions are affected?** Grokability Snipe-IT through 8.6.3.

**Is there a fix for CVE-2026-86742?** A patch was published on 2026: Fixed in version 8.7.0 (commit 2fc38b1) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86742 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86742?** Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a CSV formula injection (CWE-1236) in the postAssetAcceptanceReport() method of ReportsController.php. The CSV export fails to neutralize formula prefix characters (=, +, -, @, tab, CR) despite importing and using the League\Csv\EscapeFormula helper in six other exports in the same controller. An authenticated user with ordinary create/edit rights on asset records can inject formulas into free-text fields (asset name/tag, company name, category, model, or assignee display name) that appear in the report. When a user with reports.view privileges requests the CSV export and opens it in a spreadsheet application, the formulas are evaluated in the context of the victim's workstation, enabling data exfiltration via HYPERLINK/WEBSERVICE or DDE command execution on legacy Windows Excel. The fix applies the same EscapeFormula escaping pattern already used by sibling exports, gated on the config('app.escape_formulas') setting. This vulnerability was patched in version 8.7.0.

## Affected products

- Grokability Snipe-IT through 8.6.3

## Timeline

- 2026-09-09: disclosed
- 2026: patched: Fixed in version 8.7.0 (commit 2fc38b1)

## References

- [https://github.com/grokability/snipe-it/commit/6976f1215444bcfeda50975a5673e8422bcab4bb](https://github.com/grokability/snipe-it/commit/6976f1215444bcfeda50975a5673e8422bcab4bb)
- [https://github.com/grokability/snipe-it/security/advisories/GHSA-w4xq-9p85-4qmv](https://github.com/grokability/snipe-it/security/advisories/GHSA-w4xq-9p85-4qmv)

## Related threats

- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)
- [Snipe-IT stored cross-site scripting in department names](https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names)
- [Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num](https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped)
- [Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation)