CVE-2026-115943

UNKNOWN 0.0

Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it. An attacker who supplies an XLSX file can run arbitrary Perl code.

CWE	CWE-95
Published	Oct 29, 2026
Last Updated	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for

Be the first to know when new unknown vulnerabilities are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

References

NVD ↗ CVE.org ↗ EPSS Data ↗

metacpan.org: https://metacpan.org/release/ASB/Spreadsheet-XLSX-0.19/changes openwall.com: http://www.openwall.com/lists/oss-security/2026/10/30/3

Credits

🔍 Allen Jeanine