Fleet: CSV Injection in the Host Inventory Export

Anyone who controls a host or holds an enroll secret writes formulas into host fields that run in the Fleet user's spreadsheet when the CSV export is opened.

Advisory ID: TP-2026-117
Product: Fleet (device management and osquery server)
Vulnerability type: CSV/formula injection (CWE-1236)
CVE: requested (GitHub CNA), assignment pending
CVSS 3.1: 4.4 (Medium) · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected versions: < 4.92.0
Vendor advisory: GHSA-jc37-mgx5-356v
Fixed in: 4.92.0
Reported: 13 June 2026

Summary

Fleet manages endpoints through osquery agents and offers a CSV export of the host inventory at GET /api/latest/fleet/hosts/report?format=csv. The export writes fields such as hostname, computer name, serial number, hardware model and OS version into the file unchanged, without neutralizing values that spreadsheet applications evaluate as formulas. The osquery agent supplies these fields, so anyone who controls an enrolled host or holds an enroll secret sets them. When a Fleet user exports the list and opens it in Excel, LibreOffice Calc or Google Sheets, the application evaluates the attacker's values as formulas.

Root cause

hostsReportResponse.HijackRender serializes the hosts with gocsv.Marshal (server/service/hosts.go:2766) and writes the rows with csv.NewWriter(w).WriteAll (server/service/hosts.go:2819), which applies CSV quoting only and does not neutralize cells starting with =, +, - or @. The exported fields carry csv tags directly on the Host struct, among them hostname, os_version, hardware_model, hardware_serial and computer_name (server/fleet/hosts.go:303, :311, :324, :326, :327). These values come from the osquery agent's detail report and can be set already at enrollment through host_details.system_info. The route /api/_version_/fleet/hosts/report is registered on the ue endpointer for any authenticated user (server/service/handler.go:487), so the observer role also triggers the export.

Proof of Concept

POST /api/v1/osquery/enroll                (with a valid enroll secret)
{"enroll_secret":"<secret>","host_identifier":"x",
 "host_details":{"system_info":{"hostname":"=2+5+cmd|calc","computer_name":"@SUM(1+1)",
  "hardware_serial":"PWN123","uuid":"csvinj-uuid-001"},"os_version":{"name":"=HYPERLINK(0)"}}}

GET /api/latest/fleet/hosts/report?format=csv   (observer token)
-> ...,=2+5+cmd|calc,csvinj-uuid-001,...,=HYPERLINK(0) ,...,PWN123,@SUM(1+1),...

The attacker's values reach the file without a leading ' or tab. When the user opens it in a spreadsheet application, the cells are treated as formulas.

Impact

  • Exfiltration of spreadsheet data through formulas such as HYPERLINK or WEBSERVICE once the user opens the file.
  • Command execution on the user's workstation on legacy configurations with DDE enabled.
  • Triggered by any Fleet user down to the observer role; current spreadsheet applications first show a security warning the user has to accept.

References

Is Something Like This in Your Software?

Our team found this vulnerability in the course of its work. Have your applications tested by the same specialists, with a penetration test from turingpoint.

Request a Pentest