Log in Start free

Vulnerability · Published Oct 29, 2026 · Assigned by CPANSec

CVE-2026-115943Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt

Critical 9.8

In plain English

A critical-severity security flaw in Spreadsheet-XLSX. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.6%top 50.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it. An attacker who supplies an XLSX file can run arbitrary Perl code.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libspreadsheet-xlsx-perlno fix listedDEBIAN-CVE-2026-115943
Debian:13libspreadsheet-xlsx-perlno fix listedDEBIAN-CVE-2026-115943
Debian:14libspreadsheet-xlsx-perl0.20-1DEBIAN-CVE-2026-115943
Ubuntu:22.04:LTSlibspreadsheet-xlsx-perlno fix listedUBUNTU-CVE-2026-115943
Ubuntu:24.04:LTSlibspreadsheet-xlsx-perlno fix listedUBUNTU-CVE-2026-115943
Ubuntu:26.04:LTSlibspreadsheet-xlsx-perlno fix listedUBUNTU-CVE-2026-115943
Ubuntu:26.10libspreadsheet-xlsx-perlno fix listedUBUNTU-CVE-2026-115943

Affected products (as reported)

VendorProductVersions
Spreadsheet-XLSX 0 – before 0.19

Weakness: CWE-95 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References