CVE-2026-115943
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number…
- Risk score
- 67/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 29 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval …
- Affected
- See advisory
- Fix
- Upgrade the product to 0.19 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it. An attacker who supplies an XLSX file can run arbitrary Perl code.
Last activity 29 Oct 2026. Patch Forecast updates every hour.