CVE-2026-86020 Part-DB CVE debrief

Who should care

Defenders responsible for Part-DB systems, particularly those using versions prior to 2.13.2, should assess their exposure and take steps to mitigate the vulnerability. This includes verifying the current version of Part-DB in use, reviewing access controls for part import/export functionality, and monitoring for potential suspicious activity. Additionally, defenders should prioritize updating to version 2.13.2 or later to patch the vulnerability and apply

Why it matters

CVE-2026-86020 is a medium-severity vulnerability in Part-DB that allows an authenticated user to inject spreadsheet formulas into XLSX exports. Defenders should verify exposure, assess impact, and prioritize updating to version 2.13.2 or later.

• Potential execution of malicious spreadsheet formulas when opening exported XLSX files.
• Possible unauthorized access to sensitive data through part import/export functionality.
• Required verification of Part-DB version and exposure to determine potential impact.
• Necessity to update to version 2.13.2 or later to patch the vulnerability.

Technical summary

The vulnerability exists in the part import/export workflow of Part-DB, allowing an authenticated user to import a CSV file containing formula-prefixed values. These values are written to an XLSX spreadsheet without proper neutralization, potentially leading to executable spreadsheet formula cells. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, particularly if they are using Part-DB versions prior to 2.13.2.

Recommended defensive actions

• Verify if the system is using a vulnerable version of Part-DB and update to version 2.13.2 or later.
• Restrict access to part import/export functionality to minimize the attack surface.
• Monitor for suspicious activity related to part imports and exports.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is confirmed in Part-DB versions prior to 2.13.2. The CVE record and NVD entry provide details on the vulnerability, but further verification is needed to determine the full scope of affected systems and potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.