{"id":"CVE-2026-115943","kind":"vulnerability","aliases":["CVE-2026-115943"],"related":[],"title":"Spreadsheet::XLSX for Perl: crafted spreadsheet runs arbitrary code on parse","description":"Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.\n\nWhen a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it.\n\nAn attacker who supplies an XLSX file can run arbitrary Perl code.","summary":"Spreadsheet::XLSX versions before 0.19 pass number format conditions from an XLSX file into a Perl string eval while the file is parsed. A person who gets a crafted spreadsheet processed by the library can make it run arbitrary Perl code.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","perl","spreadsheet-xlsx"],"not_affected_if":["no-untrusted-xlsx-input","version-0.19-or-later"],"how_to_check":"- Check the installed version with `perl -MSpreadsheet::XLSX -e 'print $Spreadsheet::XLSX::VERSION'` or `cpanm --info Spreadsheet::XLSX`\n- Search dependency manifests and lockfiles for `Spreadsheet::XLSX` to find projects that pull it in","fix":"- Spreadsheet::XLSX: `0.19` or later (per the sources, versions before 0.19 are affected)","status":"open","published_at":"2026-10-29T22:17:00+00:00","first_seen_at":"2026-10-29T22:27:06+00:00","triaged_at":"2026-10-29T22:28:51+00:00","updated_at":"2026-10-29T22:28:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T22:28:51Z","model":"claude-haiku-5-5","output":{"fix":"- Spreadsheet::XLSX: `0.19` or later (per the sources, versions before 0.19 are affected)","reach":"unknown","title":"Spreadsheet::XLSX for Perl: crafted spreadsheet runs arbitrary code on parse","impact":"high","summary":"Spreadsheet::XLSX versions before 0.19 pass number format conditions from an XLSX file into a Perl string eval while the file is parsed. A person who gets a crafted spreadsheet processed by the library can make it run arbitrary Perl code.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","spreadsheet-xlsx"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs arbitrary Perl code on the parsing server","analyst_note":"Sources list no severity, no CVSS and no fix link beyond the version; confirm the 0.19 fix and whether user interaction is needed to trigger parsing at the NVD entry.","how_to_check":"- Check the installed version with `perl -MSpreadsheet::XLSX -e 'print $Spreadsheet::XLSX::VERSION'` or `cpanm --info Spreadsheet::XLSX`\n- Search dependency manifests and lockfiles for `Spreadsheet::XLSX` to find projects that pull it in","plain_action":"","needs_analyst":true,"not_affected_if":["version-0.19-or-later","no-untrusted-xlsx-input"],"who_is_affected":"Any Perl program that calls Spreadsheet::XLSX->new on spreadsheets that could come from outside the team, such as user uploads, email attachments or data feeds. Programs that only read files the team itself creates, or that never load this module, are not exposed.","user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000746,"input_tokens":4175,"output_tokens":657,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115943':14A,17A '-2026':13A,16A '0.19':27B,68C '100':92C 'allow':71C 'arbitrari':8A,61B,134C 'attack':126C 'cell':104C 'choos':94C 'code':9A,63B,72C,136C 'come':111C 'condit':31B,80C,89C,101C 'craft':5A,51B 'cve':12A,15A 'eval':40B,76C,109C,117C 'excelfmt':82C,93C 'execut':73C 'file':35B,43B,131C 'format':30B,79C,86C,96C 'get':49B 'librari':56B 'make':58B 'new':122C 'number':29B,78C,85C 'packag':18B 'pars':11A,45B,123C 'pass':28B,99C 'perl':4A,19B,38B,62B,70C,135C 'person':47B 'process':53B 'run':7A,60B,118C,133C 'section':97C 'spreadsheet':1A,6A,21B,23B,52B,64C,120C 'spreadsheet-xlsx':20B 'string':39B,75C,108C 'suppli':128C 'valu':105C 'version':25B,66C 'via':74C 'workbook':114C 'xlsx':2A,22B,24B,34B,65C,121C,130C","nicknames":[],"mitigations":[],"who_affected":"Any Perl program that calls Spreadsheet::XLSX->new on spreadsheets that could come from outside the team, such as user uploads, email attachments or data feeds. Programs that only read files the team itself creates, or that never load this module, are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T22:17:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115943","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115943","severity":null,"published_at":"2026-10-29T22:17:00+00:00","modified_at":"2026-10-29T22:17:00+00:00","first_seen_at":"2026-10-29T22:27:06+00:00","fetched_at":"2026-10-29T22:27:06+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}