The vulnerability allows an attacker with local access to craft a process name that begins with a formula character such as =, +, -, or @. When Dool exports data to a CSV file, the unsanitized process name is written directly into a cell, and if a user opens the file in a spreadsheet application, the spreadsheet interprets it as a formula and executes arbitrary code. This is a typical formula injection (CWE-1236) that can lead to the execution of unintended code on the victim’s machine. The impact is therefore local code execution or broader compromise if the victim’s spreadsheet application runs with elevated privileges. No remote trigger is required; an attacker must have the ability to run or create a process on the host running Dool.

The affected product is Dool, a project‑management tool by scottchiefbaker. Versions up to and including 1.3.8 are vulnerable. The fix was merged in pull request #117, and the patch is available in releases newer than 1.3.8.

The CVSS score is 4.6, indicating moderate severity. EPSS data is not available, so the current likelihood of exploitation is unclear. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been reported as a known exploited vulnerability. Attackers need local execution privileges on the server or the ability to influence the creation of a process with a specially crafted name. The vulnerability is therefore limited to environments where malicious processes can be introduced and feeds into CSV exports. Once exported, a user opening the file can trigger malicious formulas inside an office spreadsheet application.