{"id":"CVE-2026-115943","title":"Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt","summary":"Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.\n\nWhen a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condit…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"adp","cwe":["CWE-95"],"product":"Spreadsheet-XLSX","affected":["Spreadsheet-XLSX < 0.19"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-11-05T21:39:19.623527Z"},"published":"2026-10-29","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:39:40.214Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115943","references":[{"url":"https://metacpan.org/release/ASB/Spreadsheet-XLSX-0.19/changes"}],"tags":["cve.org"],"epss":0.0061,"epssPercentile":0.49475,"ingestedAt":"2026-11-05T16:24:31.322Z","slug":"CVE-2026-115943","body":"## Overview\n\nSpreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.\n\nWhen a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it.\n\nAn attacker who supplies an XLSX file can run arbitrary Perl code.\n\n## Affected\n\n- `Spreadsheet-XLSX < 0.19`\n\n## Remediation\n\nUpgrade to Spreadsheet-XLSX 0.19 or later.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":234907,"id":"CVE-2026-115943","ts":1793918475500,"field":"cvss","old":null,"new":"9.8"},{"seq":234906,"id":"CVE-2026-115943","ts":1793918475500,"field":"severity","old":"none","new":"critical"}]}