Spreadsheet::XLSX before 0.19 allows code execution via ExcelFmt eval
Original title: CVE-2026-115943: Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt
A crafted Excel number-format condition is passed to Perl string eval inside ExcelFmt.
Stig Palmquist reported CVE-2026-115943 in the Perl Spreadsheet::XLSX distribution. Versions before 0.19 can execute code when number-format conditions are evaluated with string eval in ExcelFmt. The oss-security post links the MetaCPAN distribution and GitHub repository; the message body in the feed is truncated.
Unconfirmed: The mailing-list body is truncated, so the exact trigger is not shown.
- CVE-2026-115943 affects Spreadsheet::XLSX before 0.19.
- The flaw is string eval of number-format conditions in ExcelFmt.
- The report was posted to oss-security on October 29.
Impact: code execution via Perl string eval
| Product | Affected | Fixed in |
|---|---|---|
| Spreadsheet::XLSX | before 0.19 | 0.19 |
- 1.Upgrade Spreadsheet::XLSX to 0.19 or later.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115943 | Code execution in Perl Spreadsheet::XLSX before 0.19 | 9.8 | — |
From the original article
Posted by Stig Palmquist on Oct 29 ======================================================================== https://metacpan. org/dist/Spreadsheet-XLSX https://github. com/asb-capfan/Spreadsheet-XLSX...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.