CVE-2026-115943

Received Received - Intake

Code Execution in Spreadsheet::XLSX Perl Module

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: CPANSec

Description

Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it. An attacker who supplies an XLSX file can run arbitrary Perl code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-29

Last Modified

2026-10-29

Generated

2026-10-30

AI Q&A

2026-10-30

EPSS Evaluated

N/A

NVD

CVE-2026-115943

EUVD

EUVD-2026-113403

Affected Vendors & Products

Vendor	Product	Version / Range
spreadsheet	xlsx	to 0.19 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-95	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

Executive Summary

This vulnerability exists in Spreadsheet::XLSX versions before 0.19 for Perl. It allows code execution through string eval of number format conditions in Excel files. When a number format includes a condition like [>100], the library evaluates it using Perl's string eval function. Since both the condition and cell value come from the workbook, an attacker can craft an XLSX file to run arbitrary Perl code during parsing.

Detection Guidance

Detecting this vulnerability requires inspecting XLSX files for malicious number format conditions. Check files for conditions like [>100] or similar in ExcelFmt sections. Use tools like grep or file inspection utilities to scan for suspicious patterns in XLSX files.

Impact Analysis

If you process untrusted XLSX files using a vulnerable version of Spreadsheet::XLSX, an attacker could execute malicious code on your system. This could lead to data theft, system compromise, or further network infiltration. The attack occurs silently during file parsing without user interaction.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized code execution. For GDPR, it may lead to data breaches or unauthorized processing. For HIPAA, it could compromise protected health information. Organizations must ensure vulnerable software is patched to maintain compliance.

Mitigation Strategies

Upgrade Spreadsheet::XLSX to version 0.19 or later. Avoid opening untrusted XLSX files. Implement file validation and sandboxing for XLSX processing. Review and restrict Perl eval usage in your environment.

Hi! I’m here to help you understand CVE-2026-115943. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70