SZB-bff99e0f1b
EUVD lists code execution via crafted number formats in Spreadsheet::XLSX before 0.19
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Spreadsheet::XLSX
- Product
- Spreadsheet::XLSX
- First seen
Summary
The EUVD entry EUVD-2026-113403 says Spreadsheet::XLSX versions before 0.19 for Perl allow code execution through string eval of number format conditions in ExcelFmt, using values from the workbook. The item gives no CVSS score.
If you use Spreadsheet::XLSX
Upgrade Spreadsheet::XLSX to version 0.19 or later
Avoid parsing untrusted workbooks until patched
What the sources say 1
· Mastodon: “Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.” Source