OpenPanel versions up to 2.3.0 allow an attacker who can hit the /track endpoint to inject spreadsheet formulas by crafting profile IDs such as =HYPERLINK(...). When the affected system later exports a cohort to a CSV file, the injected formulas are executed in the spreadsheet client, causing the attacker to read the values of adjacent cells and thereby exfiltrate confidential data. The weakness is classified as CWE-1236, a formula injection flaw that compromises integrity and confidentiality of exported data.

The affected product is Openpanel, maintained by Openpanel‑dev, with all releases up to and including version 2.3.0 vulnerable. There is currently no documented higher‑than‑2.3.0 version in the data set, so any installation of Openpanel 1.x through 2.3.0 is susceptible.

The published CVSS score of 2.3 indicates low overall risk; however, the vulnerability is exploitable by unauthenticated users who can send tracking events. The absence of an EPSS score and a KEV listing reduces immediate threat perception, yet the technique still allows a malicious actor to ingest sensitive data from exported CSVs. Exploitation requires the attacker to create a tracking event with a specially crafted profile ID and subsequently trigger the cohort CSV export. Successful exploitation results in data leakage but does not provide remote code execution or system compromise beyond the exported file.