{"id":"RSEC-2023-9","summary":"Arbitrary Code Execution (ACE) Vulnerability","details":"Bundled Perl script Spreadsheet::ParseExcel version 0.65 is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type \"eval\". Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic. Fixed with the depreation of Excel-related functionality from gdata version 3.0.0 -- upgrading advised.","modified":"2025-05-19T19:43:48.455096Z","published":"2025-05-16T00:12:44Z","upstream":["CVE-2023-7101"],"references":[{"type":"WEB","url":"https://security-tracker.debian.org/tracker/CVE-2023-7101"},{"type":"WEB","url":"https://github.com/r-gregmisc/gdata/issues/14"}],"affected":[{"package":{"name":"gdata","ecosystem":"CRAN","purl":"pkg:cran/gdata"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.1"},{"fixed":"3.0.0"}]}],"versions":["2.16.1","2.17.0","2.18.0","2.18.0.1","2.19.0"],"database_specific":{"source":"https://github.com/RConsortium/r-advisory-database/blob/main/vulns/gdata/RSEC-2023-9.yaml"}}],"schema_version":"1.7.3"}