Code Execution Vulnerability in Spreadsheet::XLSX for Perl
CVE-2026-115943

Currently unrated

Key Information:

Status
Vendor
CVE Published:
29 October 2026

What is CVE-2026-115943?

A vulnerability exists in Spreadsheet::XLSX versions prior to 0.19 for Perl, allowing an attacker to execute arbitrary Perl code through specially crafted XLSX files. When the library processes Excel number formats with conditional expressions like [>100], it invokes a string evaluation that can be manipulated by attackers. Consequently, this could lead to unauthorized code execution in environments leveraging the affected versions. Proper validation and updates to version 0.19 or higher are recommended to mitigate this risk.

References

https://metacpan.org/release/ASB/Spreadsheet-XLSX-0.19/ch...
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Allen Jeanine
.