CVE-2026-115943: Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.
When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it.
An attacker who supplies an XLSX file can run arbitrary Perl code.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libspreadsheet-xlsx-perlto a version that resolves this vulnerability.Fixed in 0.20-1 - Upgrade
Upgrade
Spreadsheet::XLSXto a version that resolves this vulnerability.Fixed in 0.19
Event History
Frequently Asked Questions
What attacker access is required to exploit this issue?
An attacker needs to supply an XLSX workbook that is subsequently parsed by an application using the affected Perl library. Arbitrary Perl code can run during the Spreadsheet::XLSX->new parsing operation.
Which workbook content triggers the vulnerable path?
The vulnerable path is reached when a number format includes a condition, such as [>100]. The condition and cell value originate from the workbook and are passed to a string eval while ExcelFmt selects a format section.
What should be prioritized for remediation?
Upgrade Spreadsheet::XLSX to version 0.19 or later. Until upgrading is possible, avoid parsing XLSX files supplied by untrusted parties with affected versions.