Spreadsheet::XLSX before 0.19 allows code execution via ExcelFmt eval
A crafted Excel number-format condition is passed to Perl string eval inside ExcelFmt.
48
Vulnerability1 · 1 read
CVE-2026-115943
Code execution in Perl Spreadsheet::XLSX before 0.19
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Spreadsheet::XLSX before 0.19 evaluates number-format conditions in ExcelFmt with a Perl string eval while Spreadsheet::XLSX->new parses a workbook. Both the condition (such as [>100]) and the cell value come from the file. Anyone who can get an application to open a crafted XLSX can run arbitrary Perl code in that process. Apps and scripts that parse untrusted workbooks with this module are affected.
What to do: Upgrade Spreadsheet::XLSX to 0.19 or later before parsing untrusted XLSX files.
| Product | Affected | Fixed in |
|---|---|---|
| Perl Spreadsheet::XLSX | before 0.19 | 0.19 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it. An attacker who supplies an XLSX file can run arbitrary Perl code.
- Weakness
- CWE-95
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H