CVE-2026-115943

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115943", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-10-23T21:59:48.535Z", "datePublished": "2026-10-29T21:37:40.697Z", "dateUpdated": "2026-11-05T21:39:40.214Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Spreadsheet::XLSX"], "packageName": "Spreadsheet-XLSX", "packageURL": "pkg:cpan/Spreadsheet-XLSX", "programFiles": ["lib/Spreadsheet/XLSX/Utility2007.pm"], "programRoutines": [{"name": "Spreadsheet::XLSX::Utility2007::ExcelFmt"}], "repo": "https://github.com/asb-capfan/Spreadsheet-XLSX", "versions": [{"lessThan": "0.19", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Allen Bertoldo"}], "descriptions": [{"lang": "en", "value": "Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.\n\nWhen a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it.\n\nAn attacker who supplies an XLSX file can run arbitrary Perl code."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-95", "description": "CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-30T18:27:48.508Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/release/ASB/Spreadsheet-XLSX-0.19/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to Spreadsheet-XLSX 0.19 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/30/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-30T02:08:11.510Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T21:39:19.623527Z", "id": "CVE-2026-115943", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:39:40.214Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/30/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-30T02:08:11.510Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-115943", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-05T21:39:19.623527Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:39:34.936Z"}}], "cna": {"title": "Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Allen Bertoldo"}], "affected": [{"repo": "https://github.com/asb-capfan/Spreadsheet-XLSX", "modules": ["Spreadsheet::XLSX"], "versions": [{"status": "affected", "version": "0", "lessThan": "0.19", "versionType": "custom"}], "packageURL": "pkg:cpan/Spreadsheet-XLSX", "packageName": "Spreadsheet-XLSX", "programFiles": ["lib/Spreadsheet/XLSX/Utility2007.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Spreadsheet::XLSX::Utility2007::ExcelFmt"}]}], "solutions": [{"lang": "en", "value": "Upgrade to Spreadsheet-XLSX 0.19 or later."}], "references": [{"url": "https://metacpan.org/release/ASB/Spreadsheet-XLSX-0.19/changes", "tags": ["release-notes"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.\n\nWhen a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it.\n\nAn attacker who supplies an XLSX file can run arbitrary Perl code."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-95", "description": "CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-30T18:27:48.508Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115943", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:39:40.214Z", "dateReserved": "2026-10-23T21:59:48.535Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-10-29T21:37:40.697Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Spreadsheet::XLSX"], "packageName": "Spreadsheet-XLSX", "packageURL": "pkg:cpan/Spreadsheet-XLSX", "programFiles": ["lib/Spreadsheet/XLSX/Utility2007.pm"], "programRoutines": [{"name": "Spreadsheet::XLSX::Utility2007::ExcelFmt"}], "repo": "https://github.com/asb-capfan/Spreadsheet-XLSX", "versions": [{"lessThan": "0.19", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.\n\nWhen a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it.\n\nAn attacker who supplies an XLSX file can run arbitrary Perl code."}], "id": "CVE-2026-115943", "lastModified": "2026-11-05T22:17:48.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115943", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:39:19.623527Z", "version": "2.0.3"}}]}, "published": "2026-10-29T22:17:00.767", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/ASB/Spreadsheet-XLSX-0.19/changes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/30/3"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-95"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-spreadsheet-xlsx: Spreadsheet::XLSX: Arbitrary code execution via crafted number format conditions", "id": "2563716", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563716"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-94", "details": ["Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.\nWhen a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it.\nAn attacker who supplies an XLSX file can run arbitrary Perl code.", "A flaw was found in Spreadsheet::XLSX. This vulnerability can lead to arbitrary code execution when the library processes a spreadsheet containing crafted number format conditions. The module improperly evaluates workbook-supplied formatting conditions as code during file parsing. An attacker can exploit this flaw by providing a malicious spreadsheet file, potentially executing arbitrary commands with the privileges of the application processing the file."], "name": "CVE-2026-115943", "public_date": "2026-10-29T21:37:40Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115943\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115943\nhttps://metacpan.org/release/ASB/Spreadsheet-XLSX-0.19/changes"], "statement": "This flaw is rated as Important severity because an attacker can achieve arbitrary code execution in the context of the running application by inducing it to parse an untrusted workbook, though successful exploitation relies on user interaction or services ingesting untrusted files. Red Hat Enterprise Linux does not include the perl-Spreadsheet-XLSX package in core distribution repositories, as it is only distributed through community channels such as Extra Packages for Enterprise Linux (EPEL). Consequently, enterprise environments are not exposed by default, limiting the potential attack surface to custom installations that explicitly integrate this Perl module.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": ["perl"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.19)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "spreadsheet::xlsx", "vendor": "perl"}], "created": "2026-10-29T22:30:13.625381+00:00", "updated": "2026-11-05T23:30:16.313905+00:00", "vendors": ["perl", "perl$PRODUCT$spreadsheet::xlsx"]}