Back to CVE Browser

CVE-2023-7101

🔥 Known Exploited (CISA KEV)HIGH

7.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2023-12-24

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.

Affected Platforms (CPE)

📦

Jmcnamara

Spreadsheet\

<= 0.65

💻

Debian

Debian Linux

= 10.0

💻

Fedoraproject

Fedora

= 38= 39

References & Advisories

🔗 http://www.openwall.com/lists/oss-security/2023/12/29/4

🔗 https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171

🔗 https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md

🔗 https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc

🔗 https://https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc

🔗 https://https://metacpan.org/dist/Spreadsheet-ParseExcel

🔗 https://https://www.cve.org/CVERecord?id=CVE-2023-7101

🔗 https://lists.debian.org/debian-lts-announce/2023/12/msg00025.html

Related Vulnerabilities

CVE-2026-542436.1

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, form submission values in src/...

CVE-2026-151604.3

The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3...

CVE-2026-151594.3

The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and i...

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vuln...