by Kastro
Paper/Archive/CVE-2026-115943

CVE-2026-115943

CPANSec — Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
33
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 17.1.171 × 203.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it. An attacker who supplies an XLSX file can run arbitrary Perl code.

Affected

ProductAffectedFixed inSource
Spreadsheet-XLSX< 0.190.19CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refmetacpan.org/release/ASB/Spreadsheet-XLSX-0.19/changesrefopenwall.com/lists/oss-security/2026/10/30/3