CVE-2026-108579

OpenPanel versions through 2.3.0 are vulnerable to a CSV formula injection vulnerability via the Cohort Member Export feature. Unauthenticated attackers can supply crafted profile IDs (e.g., =HYPERLINK(...)) to the /track endpoint. When a cohort is exported to a CSV file, these embedded formulas ...