{"id":"CVE-2023-7101","state":"PUBLISHED","title":"Arbitrary Code Execution (ACE) Vulnerability","description":"Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.","publishedAt":"2023-12-24T21:34:46.527Z","updatedAt":"2025-10-21T23:05:29.481Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"Mandiant","products":["Douglas Wilson Spreadsheet::ParseExcel"],"affected":[{"vendor":"Douglas Wilson","product":"Spreadsheet::ParseExcel","packageName":"Spreadsheet::ParseExcel","defaultStatus":"affected","versions":[{"version":"0.65","status":"affected"}],"collectionURL":"https://metacpan.org/pod/Spreadsheet::ParseExcel","repo":"https://metacpan.org/release/DOUGW/Spreadsheet-ParseExcel-0.65/source/lib/Spreadsheet"}],"references":["https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md","https://https://www.cve.org/CVERecord?id=CVE-2023-7101","https://https://metacpan.org/dist/Spreadsheet-ParseExcel","https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc","https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171","http://www.openwall.com/lists/oss-security/2023/12/29/4","https://lists.debian.org/debian-lts-announce/2023/12/msg00025.html","https://https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFEHKULQRVXHIV7XXK2RGD4VQN6Y4CV5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2FIWDHRYTAAQLGM6AFOZVM7AFZ4H2ZR/","https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7101"],"weaknesses":["CWE-95"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/7xxx/CVE-2023-7101.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-7101","state":"PUBLISHED","datePublished":"2023-12-24T21:34:46.527Z","dateUpdated":"2025-10-21T23:05:29.481Z","assignerShortName":"Mandiant","assignerOrgId":"027e81ed-0dd4-4685-ab4d-884aec5bb484","dateReserved":"2023-12-24T16:23:02.000Z"},"containers":{"cna":{"title":"Arbitrary Code Execution (ACE) Vulnerability","descriptions":[{"lang":"en","value":"Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic."}],"affected":[{"vendor":"Douglas Wilson","product":"Spreadsheet::ParseExcel","packageName":"Spreadsheet::ParseExcel","defaultStatus":"affected","versions":[{"version":"0.65","status":"affected"}],"collectionURL":"https://metacpan.org/pod/Spreadsheet::ParseExcel","repo":"https://metacpan.org/release/DOUGW/Spreadsheet-ParseExcel-0.65/source/lib/Spreadsheet"}],"references":[{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md"},{"url":"https://https://www.cve.org/CVERecord?id=CVE-2023-7101"},{"url":"https://https://metacpan.org/dist/Spreadsheet-ParseExcel"},{"url":"https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc"},{"url":"https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171"},{"url":"http://www.openwall.com/lists/oss-security/2023/12/29/4"},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00025.html"},{"url":"https://https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFEHKULQRVXHIV7XXK2RGD4VQN6Y4CV5/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2FIWDHRYTAAQLGM6AFOZVM7AFZ4H2ZR/"},{"url":"https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-95","description":"CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Mandiant","orgId":"027e81ed-0dd4-4685-ab4d-884aec5bb484","dateUpdated":"2024-05-05T14:52:28.089Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Le Dinh Hai (https://github.com/haile01/perl_spreadsheet_excel_rce_poc/tree/main)"},{"lang":"en","type":"reporter","user":"00000000-0000-4000-9000-000000000000","value":"Barracuda Networks Inc.  https://www.barracuda.com/"}],"impacts":[{"capecId":"CAPEC-137","descriptions":[{"lang":"en","value":"CAPEC-137: Parameter Injection"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update to version 0.66<br>"}],"value":"Update to version 0.66"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"jmcnamara","product":"spreadsheet\\","defaultStatus":"unknown","versions":[{"version":"0.41","status":"affected","lessThanOrEqual":"0.65","versionType":"custom"}],"cpes":["cpe:2.3:a:jmcnamara:spreadsheet\\:\\:parseexcel:0.41:*:*:*:*:perl:*:*"]},{"vendor":"debian","product":"debian_linux","defaultStatus":"unknown","versions":[{"version":"10","status":"affected"}],"cpes":["cpe:2.3:o:debian:debian_linux:10:*:*:*:*:*:*:*"]},{"vendor":"fedoraproject","product":"fedora","defaultStatus":"unknown","versions":[{"version":"38","status":"affected"},{"version":"39","status":"affected"}],"cpes":["cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*"]},{"vendor":"fedoraproject","product":"fedora","defaultStatus":"unknown","versions":[{"version":"38","status":"affected"},{"version":"39","status":"affected"}],"cpes":["cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*"]}],"references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7101","tags":["government-resource"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2023-7101","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-08-20T03:56:14.026771Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2024-01-02","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7101"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-21T23:05:29.481Z"},"timeline":[{"time":"2024-01-02T00:00:00.000Z","lang":"en","value":"CVE-2023-7101 added to CISA KEV"}]},{"title":"CVE Program Container","references":[{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md","tags":["x_transferred"]},{"url":"https://https://www.cve.org/CVERecord?id=CVE-2023-7101","tags":["x_transferred"]},{"url":"https://https://metacpan.org/dist/Spreadsheet-ParseExcel","tags":["x_transferred"]},{"url":"https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc","tags":["x_transferred"]},{"url":"https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2023/12/29/4","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00025.html","tags":["x_transferred"]},{"url":"https://https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc","tags":["x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFEHKULQRVXHIV7XXK2RGD4VQN6Y4CV5/","tags":["x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2FIWDHRYTAAQLGM6AFOZVM7AFZ4H2ZR/","tags":["x_transferred"]},{"url":"https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T08:50:08.227Z"}}]}}}