This CVE is not ambiguous. Excel's formula interpretation is documented behavior spanning decades. Velociraptor's CSV export not accounting for it is an active engineering decision, and the security community has settled this question definitively: tools that export data into formats with execution semantics bear responsibility for sanitization. This is the 47th CVE in a well-documented lineage dating back to 2012, and the pattern is consistent—maintainers initially resist by arguing downstream software shouldn't interpret CSV as executable, then capitulate once deployment reality makes denial untenable.
What distinguishes this case is the DFIR context. Velociraptor runs during active incidents, generating exports that flow through analyst workstations, ticketing systems, executive dashboards, and shared drives. The "controlled environment" argument that works for SIEM connectors collapses entirely here—CSV from a forensic tool has a wider and less predictable blast radius precisely because it travels into adversarial-adjacent contexts where trust is already strained.
The advisory language is revealing. Framing this as something they "decided to highlight" treats it as a courtesy disclosure rather than a vulnerability. The phrase "common use case" in the context of unsanitized Excel consumption is a confession: they knew users routinely took this output into a spreadsheet application with formula execution, and they treated it as someone else's problem.
Patch deployment won't close the exposure. The offline collector—distributed to endpoints, analyst laptops, and customer sites—will lag the server update for months. More critically, exported CSVs already in circulation (ticketing systems, case logs, shared drives) remain exploitable indefinitely. Each re-opening is a new exposure event.
Prioritize the server-side fix, but treat existing artifacts as persistent exposure surface. Assume CSV exports already in your environment remain exploitable until explicitly regenerated.