[MEDIUM] Snipe-IT has CSV formula injection in Activity Report export

PKSA-cj32-qmb9-vwgy CVE-2026-55452 GHSA-whrx-mmgr-gpcf

Affected package: snipe/snipe-it

Affected version: <=8.6.1

Reported by:
GitHub