Vulnerabilities in dool software

CERT Polska has received a report about vulnerabilities in dool software and participated in coordination of their disclosure.

The vulnerabilityCVE-2026-56651: Dool in versions up to 1.3.8 is vulnerable to symlink following when the--develflag is used, as the application opens a log file without theO_NOFOLLOWflag. A local attacker can exploit this by creating a symlink at the expected log file path pointing to a sensitive file, causing dool to truncate and overwrite the target file with log data, which is especially impactful if dool is run with elevated privileges. The issue was addressed by pull request#116.

The vulnerabilityCVE-2026-56652: Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like=,+,-, or@. A local attacker can exploit this by running a process with a crafted name starting with=, which injects malicious formulas into the CSV output that execute when a victim opens the file in a spreadsheet application. The issue was addressed by pull request#117.

We thank Michał Majchrowicz and Marcin Wyczechowski from AFINE team for the responsible vulnerability report.