Live › vulnerability › CVE-2026-115943
Spreadsheet::XLSX versions before 0.19 pass number format conditions from an XLSX file into a Perl string eval while the file is parsed. A person who gets a crafted spreadsheet processed by the library can make it run arbitrary Perl code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 22:27 UTC. All times on this page are UTC.
Any Perl program that calls Spreadsheet::XLSX->new on spreadsheets that could come from outside the team, such as user uploads, email attachments or data feeds. Programs that only read files the team itself creates, or that never load this module, are not exposed.
No product ranges from the sources yet.
perl -MSpreadsheet::XLSX -e 'print $Spreadsheet::XLSX::VERSION' or cpanm --info Spreadsheet::XLSXSpreadsheet::XLSX to find projects that pull it in0.19 or later (per the sources, versions before 0.19 are affected)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.
When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it.
An attacker who supplies an XLSX file can run arbitrary Perl code.
This page as .md · .json · in your agent: get_signal("CVE-2026-115943")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.