Description
Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| debian_linux | debian / debian_linux | 10 | affected |
| fedora | fedoraproject / fedora | 38 | affected |
| fedora | fedoraproject / fedora | 38 | affected |
| fedora | fedoraproject / fedora | 39 | affected |
| fedora | fedoraproject / fedora | 39 | affected |
| spreadsheet\ | jmcnamara / spreadsheet\ | >= 0.41, <= 0.65 | affected |
| Spreadsheet::ParseExcel | Douglas Wilson / Spreadsheet::ParseExcel | 0.65 | affected |