UNKNOWN NVD
CVE-2026-115943
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condit
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.
When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it.
An attacker who supplies an XLSX file can run arbitrary Perl code.
References
- https://metacpan.org/release/ASB/Spreadsheet-XLSX-0.19/changes
- http://www.openwall.com/lists/oss-security/2026/10/30/3
- https://www.openwall.com/lists/oss-security/2026/10/30/3
This unknown severity vulnerability was published on 2026-10-29 via NVD.
vulnfeed aggregates 17020 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.