{"id":"CVE-2023-7101","kind":"vulnerability","aliases":["CVE-2023-7101"],"related":[],"title":"Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files","description":"Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.","summary":"Spreadsheet::ParseExcel is a Perl module for reading Excel files. A crafted Excel file makes it pass unvalidated input into a string eval, so an attacker can run arbitrary code in the process that parses the file.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2024-01-02T00:00:00+00:00","products":[{"name":"Spreadsheet::ParseExcel Spreadsheet::ParseExcel","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"jmcnamara spreadsheet\\","fixed":[],"affected":"<= 0.65","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 38","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 39","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","package","perl","spreadsheet-parseexcel"],"not_affected_if":["does-not-parse-untrusted-xls-files"],"how_to_check":null,"fix":"Apply mitigations per vendor instructions, or stop using Spreadsheet::ParseExcel if no mitigation is available (per CISA required action). Fixed version: unknown.","status":"open","published_at":"2023-12-24T22:15:07+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:02:38+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:02:38Z","model":"claude-haiku-5-5","output":{"fix":"Apply mitigations per vendor instructions, or stop using Spreadsheet::ParseExcel if no mitigation is available (per CISA required action). Fixed version: unknown.","reach":"unknown","impact":"high","summary":"Spreadsheet::ParseExcel is a Perl module for reading Excel files. A crafted Excel file makes it pass unvalidated input into a string eval, so an attacker can run arbitrary code in the process that parses the file.","category":"package","who_cares":["perl","spreadsheet-parseexcel"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code in the process parsing a crafted Excel file.","analyst_note":"Find the vendor advisory and the first fixed version of Spreadsheet::ParseExcel, and confirm which parsing path (number format strings) and default settings are affected.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["does-not-parse-untrusted-xls-files"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000484,"input_tokens":2888,"output_tokens":390,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':15A,18A '-7101':16A,19A '0.65':4A,78C 'ace':97C 'arbitrari':66B,94C 'attack':63B 'code':67B,95C 'confus':127C 'craft':49B 'cve':14A,17A 'debian':26A 'due':99C 'eval':60B,112C 'evalu':119C 'excel':12A,46B,50B,86C,136C 'execut':96C 'exploit':32B 'fedora':29A,31A 'fedoraproject':28A,30A 'file':13A,47B,51B,74B,87C,106C 'format':122C,132C 'input':56B,103C 'issu':115C 'jmcnamara':24A 'linux':27A 'logic':138C 'make':52B 'modul':8A,43B,82C 'number':121C 'packag':33B 'pars':11A,72B,85C,137C 'parseexcel':2A,21A,23A,37B,39B,76C,89C 'pass':54B,101C 'perl':7A,34B,42B,81C 'printf':130C 'printf-styl':129C 'process':70B 'read':45B 'run':65B 'specif':113C 'spreadsheet':1A,20A,22A,25A,36B,38B,75C,88C 'spreadsheet-parseexcel':35B 'stem':116C 'string':59B,110C,123C,133C 'string-typ':109C 'style':131C 'type':111C 'unvalid':55B,102C 'use':9A,83C 'version':3A,77C 'vulner':91C,98C 'within':134C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-12-24T22:15:07+00:00","kev":{"dateAdded":"2024-01-02","dueDate":"2024-01-23","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-7101","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-7101","severity":null,"published_at":"2024-01-02T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-7101","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-7101","severity":null,"published_at":"2023-12-24T22:15:07+00:00","modified_at":"2026-06-17T06:52:04+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}