CVE-2026-115943criticalCWE-95

CVE-2026-115943: falha crítica em Spreadsheet-XLSX

Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Spreadsheet-XLSX+ Monitorar libspreadsheet-xlsx-perl

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 0.6%
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it. An attacker who supplies an XLSX file can run arbitrary Perl code.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Spreadsheet-XLSX