Snipe‑IT stores the HTTP User‑Agent header from incoming requests and writes it directly into the Activity Report CSV file without escaping. An attacker can supply a User‑Agent string that contains a spreadsheet formula (e.g., =CMD|\|\… ), which will be written unmodified into the CSV. When a user opens the exported file in a spreadsheet application such as Excel or LibreOffice Calc, the formula can execute, potentially allowing arbitrary code execution or data manipulation within the host environment. This defect corresponds to CWE‑1236 – Formula Injection.

All Snipe‑IT installations running a version earlier than v8.5.0 are affected. Versions from 8.5.0 onward contain the patch that properly escapes User‑Agent values before inclusion in report exports.

The vulnerability is scored moderate (CVSS 4.8). The EPSS indicates a very low but nonzero likelihood of exploitation (< 1 %). Exploitation requires a legitimate authenticated user with permission to export activity reports and the ability to supply a crafted User‑Agent string, and the victim must subsequently open the resulting CSV in spreadsheet software. The defect is not listed in CISA KEV, suggesting no confirmed widespread exploitation at this time.