CERT Polska has disclosed two vulnerabilities in dool, a command-line tool that samples system statistics and can write them out to a log or a CSV file. Both affect every version up to and including 1.3.8, both need an attacker who is already a local user on the machine, and neither has a published severity score.
They were reported to CERT Polska, which runs Poland's national coordinated disclosure programme, by Michał Majchrowicz and Marcin Wyczechowski of the AFINE team. The team's names are worth reading twice, because coordinated reports on small open-source utilities are exactly the class of bug that usually goes unfixed for years.
A log file that follows the symlink
The first flaw, CVE-2026-56651, is a link-following issue. When dool is run with the --devel flag it opens its log file without the O_NOFOLLOW flag, which is the option that tells the operating system to refuse if the path turns out to be a symbolic link rather than a real file.
Without it, a local attacker can plant a symlink at the path where dool expects to write, pointing it at something else entirely. CERT Polska says dool will then truncate and overwrite the target with its own log data. That is destructive rather than informational: the contents of the victim file go away and statistics take their place. The advisory notes the impact is especially significant when dool is running with elevated privileges, which is the common case for a tool watching system-wide resource usage.
A process name that becomes a formula
The second, CVE-2026-56652, is CSV injection. When dool exports data, it does not sanitize cell content that begins with a formula character, meaning =, +, minus or @. A local attacker who can start a process with a crafted name beginning with = gets that name written into the CSV as a formula, and it executes when somebody later opens the file in a spreadsheet application.
The victim here is not the machine being monitored. It is the analyst on a laptop somewhere who opens the export to look at a performance graph. It is the same shape of problem as a local Linux flaw that quietly promotes an ordinary user: unremarkable on its own, useful to anyone who already has a foothold and wants a second step.
Take the fixes from upstream
The maintainer, who publishes dool under the handle scottchiefbaker, addressed the link-following issue in pull request #116 and the CSV injection in pull request #117. CERT Polska's advisory does not name a fixed release, so administrators should track the project's own releases rather than assume a patched version number, and check whether their distribution has picked the changes up. In the meantime, avoid running dool with --devel in any directory a lower-privileged user can write to, and treat its CSV exports as untrusted input before opening them in a spreadsheet.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.