CVE-2026-23873

hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Injection) through the contest rank export functionality (contestrank.xls.php and admin/ranklist_export.php). The application fails to sanitize user-supplied input (specifically the "Nickname" field) before exporting it to an .xls file (which renders as an HTML table but is opened by Excel). If a malicious user sets their nickname to an Excel formula when an administrator exports and opens the rank list in Microsoft Excel, the formula will be executed. This can lead to arbitrary command execution (RCE) on the administrator's machine or data exfiltration. A fix was not available at the time of publication.

• CWE-1236

• https://github.com/zhblue/hustoj/security/advisories/GHSA-gqwv-v7vx-2qjwExploit, Mitigation, Vendor Advisory

Published

Jan 22, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23865An integer overflow in the tt_var_load_item_variation_store …5.3
• CVE-2026-23866Incomplete validation of AI rich response messages for Insta…4.3
• CVE-2026-23868Giflib contains a double-free vulnerability that is the resu…5.1
• CVE-2026-23869A denial of service vulnerability exists in React Server Com…7.5
• CVE-2026-2387The Event Organiser plugin for WordPress is vulnerable to St…6.4
• CVE-2026-23870A denial of service vulnerability could be triggered by send…7.5
• CVE-2026-23874ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-23875CrawlChat is an open-source, AI-powered platform that transf…5.4
• CVE-2026-23876ImageMagick is free and open-source software used for editin…9.8
• CVE-2026-23877Swing Music is a self-hosted music player for local audio fi…4.3
• CVE-2026-23878HotCRP is conference review software. Starting in commit aa2…6.5
• CVE-2026-23879py7zr is a Python-based library and utility to support 7zip …8