Zero Radar
← feed
HighVulnerabilityCVE-2026-115943updated 30 Oct 2026, 02:18 UTC

Perl Excel reader can run attacker code from a crafted spreadsheet

A Perl library that reads Excel files can be tricked by a specially built spreadsheet into running hidden instructions on the computer that opens it. Only programs using this library are at risk.

Fixed in Version 0.19 or laterOfficial, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesVersion 0.19 or later · since 30 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker crafts fileXLSX with malicious number format condition
  2. 2File reaches appUploaded or emailed to the program
  3. 3Parser runsSpreadsheet::XLSX->new reads the workbook
  4. 4Eval executes codeCondition string is passed to string eval
  5. 5Code runsAttacker gains script privileges
  6. ResultAttacker runs code on the system

What happened

Spreadsheet::XLSX before 0.19 passes number-format conditions from the workbook (such as [>100]) into a Perl string eval inside ExcelFmt, so workbook content is executed as code during Spreadsheet::XLSX->new parsing.

Why it is dangerous: An attacker who can get a malicious XLSX file processed can run arbitrary Perl code with the privileges of the script, potentially taking over the system or its data.

Are you affected?

You are affected if you use Spreadsheet::XLSX older than 0.19 to parse XLSX files, especially files from untrusted sources such as uploads or email attachments.

Spreadsheet::XLSX (Perl) versions before 0.19

What to do

  1. Upgrade Spreadsheet::XLSX to version 0.19 or later
  2. Until upgraded, do not parse XLSX files from untrusted sources with the affected library
  3. Review applications that accept spreadsheet uploads and confirm they run the patched version

Timeline

  1. 29 Oct 2026, 22:17 UTC
    Publicly disclosed
  2. 30 Oct 2026, 00:30 UTC
    Reported by oss-security · oss-security
  3. 30 Oct 2026, 00:46 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 02:18 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-115943
Disclosed
29 Oct 2026, 22:17 UTC
On Zero Radar
30 Oct 2026, 00:46 UTC (3 h after disclosure)
Last change
30 Oct 2026, 02:18 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Perl Excel reader can run attacker code from a crafted spreadsheet · Zero Radar