CVE-2026-115943
NONE—CVSS v3
—CVSS v2
—
EPSS (exploit probability)
CWE-95CWE
Description
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.
When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it.
An attacker who supplies an XLSX file can run arbitrary Perl code.
Affected routers (0)
No routers currently mapped to this CVE in our database.