CVE-2026-64955: 
Velociraptor vulnerability analysis and mitigation

CVE-2026-64955 is a CSV injection vulnerability (CWE-1236) in Rapid7's Velociraptor digital forensics and incident response (DFIR) platform. The vulnerability arises because Velociraptor fails to sanitize formula-triggering characters in cells when exporting data to CSV format, allowing those cells to be executed as formulas when the exported file is opened in Microsoft Excel. All Velociraptor versions prior to 0.77.2 are affected. Disclosed on August 12, 2026, it carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Velociraptor Advisory).

The root cause is classified as CWE-1236 (Improper Neutralization of Formula Elements in a CSV File). When Velociraptor exports data to CSV — via the GUI, offline collector, or data export features — it does not escape or prefix cells that begin with formula-triggering characters such as =, +, -, or @. Microsoft Excel interprets these leading characters as formula directives upon file import, enabling arbitrary formula execution in the context of the user's spreadsheet application. Exploitation requires an attacker to control or influence data that ends up in a Velociraptor CSV export, and then social-engineer a user into opening that CSV file in Excel (GitHub Advisory, Velociraptor Advisory).

Successful exploitation can result in arbitrary code execution on the victim's workstation when the exported CSV is opened in Microsoft Excel, with a primary impact on confidentiality (rated High). An attacker could leverage Excel's formula execution capabilities — for example, via =cmd|'/c calc'!A0 or DDE-based payloads — to exfiltrate sensitive data, execute system commands, or establish persistence on the analyst's machine. Because Velociraptor is commonly used by security analysts and incident responders, a compromised analyst workstation could expose sensitive forensic investigation data or provide a foothold for lateral movement within a security operations environment (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.364%, placing it in the 29th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is non-trivial, requiring both the ability to influence data ingested by Velociraptor and user interaction (opening the CSV in Excel), which limits the attack surface.

1. Influence collected data: An attacker plants malicious data on an endpoint being investigated — for example, a file, registry key, or process name — whose value begins with a formula-triggering character (e.g., =cmd|'/c powershell -nop -w hidden -enc <base64payload>'!A1).
2. Data collection: Velociraptor collects this data during a hunt or artifact collection and stores it internally.
3. CSV export: An analyst exports the collected results to CSV via the Velociraptor GUI, offline collector, or data export feature. The malicious cell value is written unsanitized into the CSV file.
4. Social engineering / delivery: The analyst opens the exported CSV file in Microsoft Excel (a common workflow for DFIR analysts reviewing collected data).
5. Formula execution: Excel interprets the leading = (or +, -, @) character as a formula and executes the embedded command, potentially spawning a shell, exfiltrating data, or downloading a secondary payload in the context of the analyst's user account (GitHub Advisory, Velociraptor Advisory).

• File System: CSV export files from Velociraptor containing cells that begin with =, +, -, or @ followed by command-like strings (e.g., =cmd|, =HYPERLINK(, =DDE().
• Process: Unexpected child processes spawned by EXCEL.EXE, such as cmd.exe, powershell.exe, wscript.exe, or mshta.exe, shortly after a CSV file is opened.
• Logs: Windows Security Event Log entries (Event ID 4688) showing process creation with EXCEL.EXE as the parent process and a shell or scripting engine as the child.
• Network: Outbound network connections from EXCEL.EXE or its child processes to external IP addresses or domains not associated with Microsoft Office update infrastructure.

Rapid7 has released Velociraptor version 0.77.2, which addresses this vulnerability by sanitizing formula-triggering characters in CSV exports (Velociraptor Advisory). Organizations should upgrade to version 0.77.2 or later as the primary remediation. As a workaround prior to patching, analysts should avoid opening Velociraptor CSV exports directly in Microsoft Excel, or use Excel's "Text Import Wizard" with data treated as plain text rather than formulas. Additionally, disabling Dynamic Data Exchange (DDE) in Excel via Group Policy or registry settings can reduce the risk of formula-based code execution.

Rapid7 proactively issued an advisory acknowledging the ambiguity of responsibility between Velociraptor and Microsoft Excel, noting that the behavior is a well-known class of vulnerability (CSV injection) and that they chose to disclose it given how commonly analysts export Velociraptor data to CSV for review in Excel (Velociraptor Advisory). The GitHub Advisory Database classified the severity as "Moderate," reflecting the required user interaction and high attack complexity. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified at this time.