7.8
High
CVE-2023-7101 Spreadsheet::ParseExcel Remote Code Execution Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns
Not observed so far
Weakness
CWE-95
Description
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spreadsheet::ParseExcel | 0.65 | No fix stated |
| spreadsheet\ 0.41 | 0.41 → 0.65 | No fix stated |
| debian_linux | 10 | No fix stated |
| fedora | 39 | No fix stated |
| fedora | 38 | No fix stated |