{"id":"CVE-2026-115943","state":"PUBLISHED","title":"Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt","description":"Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.\n\nWhen a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it.\n\nAn attacker who supplies an XLSX file can run arbitrary Perl code.","publishedAt":"2026-10-29T21:37:40.697Z","updatedAt":"2026-10-30T02:08:11.510Z","severity":null,"assigner":"CPANSec","products":["Spreadsheet-XLSX"],"affected":[{"packageName":"Spreadsheet-XLSX","packageURL":"pkg:cpan/Spreadsheet-XLSX","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"0.19","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","modules":["Spreadsheet::XLSX"],"programFiles":["lib/Spreadsheet/XLSX/Utility2007.pm"],"programRoutines":[{"name":"Spreadsheet::XLSX::Utility2007::ExcelFmt"}],"repo":"https://github.com/asb-capfan/Spreadsheet-XLSX"}],"references":["https://metacpan.org/release/ASB/Spreadsheet-XLSX-0.19/changes","http://www.openwall.com/lists/oss-security/2026/10/30/3"],"weaknesses":["CWE-95"],"ingestedAt":"2026-10-30T02:14:07.475Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/115xxx/CVE-2026-115943.json","commit":"4162c4bdc6173c2721f85163948714be6de1e241","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-115943","state":"PUBLISHED","datePublished":"2026-10-29T21:37:40.697Z","dateUpdated":"2026-10-30T02:08:11.510Z","assignerShortName":"CPANSec","assignerOrgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateReserved":"2026-10-23T21:59:48.535Z"},"containers":{"cna":{"title":"Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt","descriptions":[{"lang":"en","value":"Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.\n\nWhen a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it.\n\nAn attacker who supplies an XLSX file can run arbitrary Perl code."}],"affected":[{"packageName":"Spreadsheet-XLSX","packageURL":"pkg:cpan/Spreadsheet-XLSX","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"0.19","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","modules":["Spreadsheet::XLSX"],"programFiles":["lib/Spreadsheet/XLSX/Utility2007.pm"],"programRoutines":[{"name":"Spreadsheet::XLSX::Utility2007::ExcelFmt"}],"repo":"https://github.com/asb-capfan/Spreadsheet-XLSX"}],"references":[{"url":"https://metacpan.org/release/ASB/Spreadsheet-XLSX-0.19/changes","tags":["release-notes"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-95","description":"CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CPANSec","orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateUpdated":"2026-10-29T21:37:40.697Z"},"credits":[{"lang":"en","type":"reporter","value":"Allen Jeanine"}],"solutions":[{"lang":"en","value":"Upgrade to Spreadsheet-XLSX 0.19 or later."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"cpansec-cna-tool 0.1"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/30/3"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-10-30T02:08:11.510Z"}}]}}}