CVE-2026-108579: Openpanel-Dev Openpanel

Medium severity, CVSS 4.2.

OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK(...) matching a cohort, so exported cohort CSVs execute formulas that exfiltrate adjacent cell data.

Affected products

• Openpanel-Dev Openpanel: up to and including 2.3.0

Published 2026-10-10. Last modified 2026-10-10.