CVE-2026-115943: Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt

As cited

Copy frozen at 2026-10-30 02:00 UTC (site build).

vulnerabilities

CVE-2026-115943: Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt

Spreadsheet::XLSX, a Perl module for reading Excel files, contains a code execution vulnerability in versions before 0.19 that stems from unsafe evaluation of number format conditions. The flaw allows an attacker to execute arbitrary code by crafting a malicious Excel file with specially formatted number conditions.

Why it matters: Developers and systems using Spreadsheet::XLSX to process untrusted Excel files face remote code execution risk and must upgrade to version 0.19 or later immediately.

Source published

2026-10-30 00:30 UTC

First seen by Cybersecurity Tracker

2026-10-30 01:00 UTC