–
Not scored
CVE-2026-115943
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt
Spreadsheet-XLSX · CWE-95 · CWE-95AffectedSpreadsheet-XLSX
FixUpdate to 0.19 or newer
PublishedOct 29, 21:37 · CPANSec
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.
Description
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it. An attacker who supplies an XLSX file can run arbitrary Perl code.
From CPANSec
Affected and fixed versions
ProductAffectedFixed inSpreadsheet-XLSXbefore 0.190.19
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known