CVE-2026-108579 [MEDIUM] – OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthe

OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK(…) matching a cohort, so exported cohort CSVs execute formulas that exfiltrate adjacent cell data.