---
id: CVE-2026-115943
title: >-
  Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via
  string eval of number format conditions in ExcelFmt
summary: >-
  Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via
  string eval of number format conditions in ExcelFmt.


  When a number format has a condition such as [>100], ExcelFmt chooses the
  format section by passing the condit…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-95
product: Spreadsheet-XLSX
affected:
  - Spreadsheet-XLSX < 0.19
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-11-05T21:39:19.623527Z'
published: '2026-10-29'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:39:40.214Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115943'
references:
  - url: 'https://metacpan.org/release/ASB/Spreadsheet-XLSX-0.19/changes'
tags:
  - cve.org
epss: 0.0061
epssPercentile: 0.49475
ingestedAt: '2026-11-05T16:24:31.322Z'
---

## Overview

Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.

When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it.

An attacker who supplies an XLSX file can run arbitrary Perl code.

## Affected

- `Spreadsheet-XLSX < 0.19`

## Remediation

Upgrade to Spreadsheet-XLSX 0.19 or later.