CVE-2026-115943 Details
Description
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it. An attacker who supplies an XLSX file can run arbitrary Perl code.
A vulnerability in Spreadsheet::XLSX versions prior to 0.19 for Perl allows arbitrary code execution through an eval injection in number format conditions within ExcelFmt. When a number format includes a condition, such as [>100], ExcelFmt evaluates the condition by passing it along with the cell value to a string eval. Both the condition and the cell value are sourced from the workbook, and the eval execution occurs during the parsing process of Spreadsheet::XLSX. This vulnerability can be exploited by supplying a crafted XLSX file that contains malicious Perl code.
Users are advised to upgrade to Spreadsheet::XLSX version 0.19 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/ASB/Spreadsheet-XLSX-0.19/changes | CPANSec | Source CodeVendor |
| http://www.openwall.com/lists/oss-security/2026/10/30/3 | CVE | AdvisoryMailing ListRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Spreadsheet::XLSX | < 0.19 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | CVE Modified | CVE |
| Oct 29, 2026 | New CVE Received | CPANSec |