{"id":"DEBIAN-CVE-2026-115943","details":"Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.  When a number format has a condition such as [\u003e100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX-\u003enew parses it.  An attacker who supplies an XLSX file can run arbitrary Perl code.","modified":"2026-10-30T07:47:21.005336378Z","published":"2026-10-29T22:17:00.767Z","upstream":["CVE-2026-115943"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-115943"}],"affected":[{"package":{"name":"libspreadsheet-xlsx-perl","ecosystem":"Debian:12","purl":"pkg:deb/debian/libspreadsheet-xlsx-perl?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17-1","0.18-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-115943.json"}},{"package":{"name":"libspreadsheet-xlsx-perl","ecosystem":"Debian:13","purl":"pkg:deb/debian/libspreadsheet-xlsx-perl?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.18-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-115943.json"}},{"package":{"name":"libspreadsheet-xlsx-perl","ecosystem":"Debian:14","purl":"pkg:deb/debian/libspreadsheet-xlsx-perl?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.18-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-115943.json"}}],"schema_version":"1.9.2"}