UBUNTU-CVE-2026-115943: Medium severity ubuntu/libspreadsheet-xlsx-perl vulnerability
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it. An attacker who supplies an XLSX file can run arbitrary Perl code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spreadsheet::XLSXto a version that resolves this vulnerability.Fixed in 0.19
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any application using Spreadsheet::XLSX before 0.19 to parse XLSX files is exposed if an attacker can supply or influence a workbook that the application opens. The code execution occurs during Spreadsheet::XLSX->new parsing.
What does an attacker need to exploit it?
The attacker needs to provide a crafted XLSX workbook containing a malicious number-format condition. No additional interaction after the vulnerable application parses the workbook is described.
Are systems affected when processing ordinary trusted spreadsheets?
The vulnerable behavior is triggered by number-format conditions from the workbook, so exposure depends on parsing a workbook containing attacker-controlled content. The data does not indicate that a special application configuration is required.
What is the available remediation?
Update Spreadsheet::XLSX to version 0.19 or later. If updating is not immediately possible, avoid parsing XLSX files from untrusted or attacker-influenced sources with the affected library.
How can I determine whether an application may be affected?
Check whether it uses the Ubuntu package libspreadsheet-xlsx-perl and whether the underlying Spreadsheet::XLSX version is earlier than 0.19. Also identify services that invoke Spreadsheet::XLSX->new on uploaded, emailed, downloaded, or otherwise externally supplied XLSX files.