CVE-2026-23873
Hustoj ≤ 26.01.31
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-23873 is a medium-severity Improper Neutralization of Formula Elements in a CSV File (CWE-1236) vulnerability in Hustoj Hustoj. Its CVSS base score is 5.2 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique User Execution (T1204); ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-15 (Information Output Filtering) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-23873 is a CSV Injection (Formula Injection) vulnerability affecting all versions of hustoj, an open-source online judge platform based on PHP, C++, MySQL, and Linux, used for ACM/ICPC and NOIP training. The issue resides in the contest rank export functionality, specifically the contestrank.xls.php and admin/ranklist_export.php scripts. These components fail to sanitize user-supplied input from the "Nickname" field before incorporating it into an exported .xls file, which is rendered as an HTML table but opened by Microsoft Excel, allowing embedded formulas to execute.
A low-privileged user, such as a registered participant, can exploit this by setting their nickname to a malicious Excel formula. When an administrator exports the contest rank list and opens the file in Microsoft Excel, the formula executes with the administrator's privileges. This can result in arbitrary command execution (RCE) on the administrator's machine or data exfiltration, as indicated by the CVSS v3.1 score of 9.0 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) and associated CWE-1236.
The GitHub security advisory at https://github.com/zhblue/hustoj/security/advisories/GHSA-gqwv-v7vx-2qjw details the vulnerability but notes that no fix was available at the time of publication on 2026-01-22. Security practitioners should monitor for patches, restrict export access, sanitize nicknames server-side, or advise administrators against opening exports in Excel until remediation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4200
Vulnerability Data
hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Injection) through the contest rank export functionality (contestrank.xls.php and admin/ranklist_export.php). The application fails to sanitize user-supplied input…
more
(specifically the "Nickname" field) before exporting it to an .xls file (which renders as an HTML table but is opened by Excel). If a malicious user sets their nickname to an Excel formula when an administrator exports and opens the rank list in Microsoft Excel, the formula will be executed. This can lead to arbitrary command execution (RCE) on the administrator's machine or data exfiltration. A fix was not available at the time of publication.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.10
Mitigating Controls (NIST 800-53 r5) AI
Output filtering/validation directly stops unneutralized formula elements from being written into CSV files.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require output neutralization for untrusted CSV content to block formula injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect formula injection but does not itself implement the mitigation.
Secure SDLC mandates input validation and output encoding that directly prevents formula injection in CSV exports.
Application security requirements include rules for safe CSV generation and handling of untrusted data.
Secure architecture principles encourage safe data export design but do not specifically address CSV formula neutralization.
Secure coding standards explicitly require neutralization of special characters when writing CSV files.