Description

CERT Polska has received a report about vulnerabilities in dool software and participated in coordination of their disclosure.

The vulnerability CVE-2026-56651: Dool in versions up to 1.3.8 is vulnerable to symlink following when the --devel flag is used, as the application opens a log file without the O_NOFOLLOW flag. A local attacker can exploit this by creating a symlink at the expected log file path pointing to a sensitive file, causing dool to truncate and overwrite the target file with log data, which is especially impactful if dool is run with elevated privileges. The issue was addressed by pull request #116.

The vulnerability CVE-2026-56652: Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting with =, which injects malicious formulas into the CSV output that execute when a victim opens the file in a spreadsheet application. The issue was addressed by pull request #117.

Credits

We thank Michał Majchrowicz and Marcin Wyczechowski from AFINE team for the responsible vulnerability report.