CVE-2026-23873

The record

hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Injection) through the contest rank export functionality (contestrank.xls.php and admin/ranklist_export.php). The application fails to sanitize user-supplied input (specifically the "Nickname" field) before exporting it to an .xls file (which renders as an HTML table but is opened by Excel). If a malicious user sets their nickname to an Excel formula when an administrator exports and opens the rank list in Microsoft Excel, the formula will be executed. This can lead to arbitrary command execution (RCE) on the administrator's machine or data exfiltration. A fix was not available at the time of publication.

Affected packages

Related vulnerabilities

• CVE-2026-89246 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV… CWE-1236
• CVE-2026-86257 wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV… CWE-1236
• CVE-2026-9852 A CSV injection vulnerability exists in SYS600. CWE-1236
• CVE-2026-56652 Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when… CWE-1236
• CVE-2026-19501 CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to… CWE-1236
• CVE-2026-64955 When Microsoft Excel imports a CSV file, it executes cells beginning with certain… CWE-1236
• CVE-2026-47705 TypeBot is a chatbot builder tool. CWE-1236
• CVE-2026-18738 Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that… CWE-1236