CVE-2026-47705

CVE-2026-47705 rates at 9.6 CVSS but 0.00378 EPSS—a 2,500x gap that tells you something real about this vulnerability. The technical severity is correct: if every step in the attack chain succeeds, an attacker achieves remote code execution through spreadsheet formulas. But the EPSS captures something the CVSS doesn't: the probability that all those steps will actually align. This CVE requires an attacker to inject malicious content, that content to persist through a chatbot conversation, an admin to specifically use the CSV export function, and then that same admin to open the resulting file in a spreadsheet with formula execution enabled. Every link in the chain is a social and environmental dependency, not a technical one. The gap should push you to ask a different question than 'how critical is this.' The question is: what kind of organization actually faces elevated risk here? The answer is one where admins export chatbot results frequently AND work in environments where spreadsheet formula protections haven't been hardened. That describes very few mature security programs—which is exactly what the EPSS is telling you. But here's the deeper problem the gap exposes: CSV export is a 'forgotten surface.' The developer who introduced it likely thought of it as a data delivery mechanism, not a display surface—so input sanitization that might have been applied to user-facing outputs was never considered. The data leaves the application clean because it's not being rendered back to users. This is a common blind spot: output encoding gets applied where data flows into browsers, but not where it flows into other applications. The fix—escaping formula characters in exported data—is trivial. What wasn't trivial was recognizing that export functions are security surfaces at all. This is where the patch-and-move-on frame gets dangerous. CSV injection has documented lineage going back to 2005, and it keeps resurfacing not because individual developers fail uniquely, but because the organizational memory of this failure mode never transfers. Each instance gets patched and published as a standalone CVE, then disappears into the NVD. The security community generates individual fixes without threading the underlying pattern through the developer ecosystem. The knowledge that 'data exported to another application's parser is still a security surface' never gets codified into the heuristics developers actually use. So yes, patch this—it's a one-line fix. But also ask whether your organization is building admin workflows that routinely bridge untrusted input into formula-capable desktop applications. If that's a pattern in your tooling, the real question isn't whether to patch this specific CVE; it's whether that architectural pattern itself is the vulnerability.

Reviewed through automated stages and approved by a human before publication.