CVE-2026-23873 is a CSV (formula) injection flaw, scored 9.0, in the hustoj online judge. The contest rank export writes the user nickname without neutralizing spreadsheet formulas, so an administrator opening the file in Excel could run attacker content. The advisory says no fix was available at publication, so protect the export path yourself.
What's affected
All hustoj versions, per the GitHub advisory, which lists no patched version. The affected files are the contest rank export (contestrank.xls.php) and the admin rank list export (admin/ranklist_export.php). Check the project repository and advisory for any later fix.
How to check if you're exposed
You are exposed if you run hustoj, let users set their own nickname, and administrators export rank lists and open them in Excel or a similar spreadsheet program. Check your instance for nickname values that start with an equals sign, plus sign, minus sign or at sign.
What to do now
- Watch the hustoj repository and the advisory for a patched release.
- Until then, have administrators avoid opening exported rank lists in Excel, or open them in a viewer that does not evaluate formulas.
- Constrain nicknames. Reject or rewrite values that begin with the characters that spreadsheets treat as formulas.
- Patch the export code locally so that cell values starting with those characters are prefixed with a single quote, as the advisory suggests.
- Keep Excel's protected view and warnings enabled on administrator machines.
Why it matters
The class is CWE-1236, improper neutralization of formula elements in a CSV file. The server never runs the formula. The risk lands on the person who opens the export, and that person is usually an administrator with broad access.
The score reflects a changed scope: the attack starts in the web app and ends on a workstation. Many modern spreadsheet programs warn before running external commands, so how far it goes depends on settings. The record does not list this CVE as known exploited.
Reading the severity score
The record gives a CVSS base score of 9.0, published 2026-01-22. In the vector, the attacker works over the network, needs a low privilege account, and the attack is low in complexity. User interaction is required. Impact on confidentiality is high, on integrity high and on availability high.
A base score describes the flaw in general, not your risk. Weigh it against how exposed your instance is and what it can reach. The Gold page for the CVE keeps the score, weakness and references together.
Quick check
Is the server itself compromised by this?
No. The advisory describes the risk to the administrator's machine when the exported file is opened.
Sources
Last reviewed: 19 October 2026.
