{"id":"CVE-2026-115943","aliases":[],"cve":{"records":[{"id":"CVE-2026-115943","source":"CPANSec","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-23T21:59:48.535Z","published":"2026-10-29T21:37:40.697Z","modified":"2026-10-30T18:27:48.508Z"}],"publishers":[{"name":"CPANSec","role":"CNA","organizationId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","modified":"2026-10-30T18:27:48.508Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-10-30T02:08:11.510Z"}],"references":[{"url":"https://metacpan.org/release/ASB/Spreadsheet-XLSX-0.19/changes","tags":["release-notes"],"source":"CPANSec"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/30/3","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-95","description":"CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","source":"CPANSec"}],"applicability":[],"prioritization":[]},"title":"Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt","titleSource":"CPANSec","descriptionSource":"CPANSec","description":"Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.\n\nWhen a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it.\n\nAn attacker who supplies an XLSX file can run arbitrary Perl code.","score":null,"severity":"unknown","published":"2026-10-29T21:37:40.697Z","modified":"2026-10-30T18:27:48.508Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"","name":"Spreadsheet-XLSX","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"0.19","versionType":"custom"}],"defaultStatus":"unaffected","packageURL":"pkg:cpan/Spreadsheet-XLSX","cpes":[],"source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-115943"}],"remediation":[{"text":"Upgrade to Spreadsheet-XLSX 0.19 or later.","source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-115943"}],"references":["https://metacpan.org/release/ASB/Spreadsheet-XLSX-0.19/changes","http://www.openwall.com/lists/oss-security/2026/10/30/3"],"sources":[{"name":"CVE","id":"CVE-2026-115943","modified":"2026-10-30T18:27:48.508Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-115943"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-30T18:59:41.027Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:15:31.262Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T23:00:39.677Z","attemptedAt":"2026-10-29T23:00:39.677Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-29T23:00:35.786Z","attemptedAt":"2026-10-29T23:00:35.786Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T23:00:36.643Z","attemptedAt":"2026-10-29T23:00:36.643Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T23:00:35.612Z","attemptedAt":"2026-10-29T23:00:35.612Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113403","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113403","modified":"Oct 29, 2026, 9:37:40 PM","checkedAt":"2026-10-29T23:00:36.643Z"},{"source":"NVD","id":"CVE-2026-115943","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115943","modified":"2026-10-29T22:17:00.767","checkedAt":"2026-10-29T23:00:39.677Z"}],"aiSummary":{"text":"Spreadsheet::XLSX versions before 0.19 for Perl may allow code execution via string eval of number format conditions in ExcelFmt, potentially letting an attacker run arbitrary Perl code by supplying an XLSX file. The weakness is due to improper neutralization of directives in dynamically evaluated code. An attacker needs to supply a malicious XLSX file.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:14:34.398Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-115943"}]}}