CVE-2023-7101
Arbitrary Code Execution (ACE) Vulnerability
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
- Record
CVE-2023-7101- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-95, CWE-94
- Updated
- 2026-11-02
CVE List
Arbitrary Code Execution (ACE) Vulnerability
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
- Record
CVE-2023-7101- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-95
- Updated
- 2026-11-02
EUVDEUVD-2023-59285
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
- Record
EUVD-2023-59285- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3c85-mx4x-435c
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet:...
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
- Record
GHSA-3c85-mx4x-435c- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-94, CWE-95
- Updated
- 2026-11-02
CISA KEV No score
Spreadsheet::ParseExcel Remote Code Execution Vulnerability
Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.
- Record
CVE-2023-7101- Weakness
- CWE-95
- Updated
- 2026-11-02
OSVALPINE-CVE-2023-7101
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
- Record
ALPINE-CVE-2023-7101- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
Show 10 moreShow less
OSV
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
- Record
CVE-2023-7101- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-7101
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
- Record
DEBIAN-CVE-2023-7101- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-2507
perl-Spreadsheet-ParseExcel security update
The Spreadsheet::ParseExcel module can be used to read information from an Excel 95-2003 file.
Security Fix(es):
Spreadsheet::ParseExcel version 0.65, a Perl module for parsing Excel files, is vulnerable to arbitrary code execution (ACE) due to passing unvalidated input from a file into a string-type eval. The issue specifically arises from the evaluation of Number format strings (distinct from printf-style format strings) within the Excel parsing logic.(CVE-2023-7101)
- Record
OESA-2025-2507- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-2508
perl-Spreadsheet-ParseExcel security update
The Spreadsheet::ParseExcel module can be used to read information from an Excel 95-2003 file.
Security Fix(es):
Spreadsheet::ParseExcel version 0.65, a Perl module for parsing Excel files, is vulnerable to arbitrary code execution (ACE) due to passing unvalidated input from a file into a string-type eval. The issue specifically arises from the evaluation of Number format strings (distinct from printf-style format strings) within the Excel parsing logic.(CVE-2023-7101)
- Record
OESA-2025-2508- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-2613
perl-Spreadsheet-ParseExcel security update
The Spreadsheet::ParseExcel module can be used to read information from an Excel 95-2003 file.
Security Fix(es):
Spreadsheet::ParseExcel version 0.65, a Perl module for parsing Excel files, is vulnerable to arbitrary code execution (ACE) due to passing unvalidated input from a file into a string-type eval. The issue specifically arises from the evaluation of Number format strings (distinct from printf-style format strings) within the Excel parsing logic.(CVE-2023-7101)
- Record
OESA-2025-2613- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-7101
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
- Record
UBUNTU-CVE-2023-7101- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13558-1 No score
perl-Spreadsheet-ParseExcel-0.660.0-1.1 on GA media
These are all security issues fixed in the perl-Spreadsheet-ParseExcel-0.660.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13558-1- Updated
- 2026-11-02
OSVRSEC-2023-9 No score
Arbitrary Code Execution (ACE) Vulnerability
Bundled Perl script Spreadsheet::ParseExcel version 0.65 is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type "eval". Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic. Fixed with the depreation of Excel-related functionality from gdata version 3.0.0 -- upgrading advised.
- Record
RSEC-2023-9- Updated
- 2026-11-02
OSVSUSE-SU-2024:0158-1 No score
Security update for perl-Spreadsheet-ParseExcel
This update for perl-Spreadsheet-ParseExcel fixes the following issues:
- CVE-2023-7101: Fixed a command injection issue when parsing an untrusted spreadsheet (bsc#1218414).
- Record
SUSE-SU-2024:0158-1- Updated
- 2026-11-02
OSVUSN-6781-1 No score
libspreadsheet-parseexcel-perl vulnerability
Le Dinh Hai discovered that Spreadsheet::ParseExcel was passing unvalidated input from a file into a string-type "eval". An attacker could craft a malicious file to achieve arbitrary code execution.
- Record
USN-6781-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
perl-spreadsheet-parseexcelAlpine:v3.18 |
before 0.66-r0 | 0.66-r0 |
perl-spreadsheet-parseexcelAlpine:v3.19 |
before 0.66-r0 | 0.66-r0 |
perl-spreadsheet-parseexcelAlpine:v3.20 |
before 0.66-r0 | 0.66-r0 |
perl-spreadsheet-parseexcelAlpine:v3.21 |
before 0.66-r0 | 0.66-r0 |
perl-spreadsheet-parseexcelAlpine:v3.22 |
before 0.66-r0 | 0.66-r0 |
perl-spreadsheet-parseexcelAlpine:v3.23 |
before 0.66-r0 | 0.66-r0 |
perl-spreadsheet-parseexcelAlpine:v3.24 |
before 0.66-r0 | 0.66-r0 |
libspreadsheet-parseexcel-perlDebian:12 |
before 0.6500-4~deb12u1, plus listed versions 0.6500-3 |
0.6500-4~deb12u1 |
libspreadsheet-parseexcel-perlDebian:13 |
before 0.6500-4 | 0.6500-4 |
libspreadsheet-parseexcel-perlDebian:14 |
before 0.6500-4 | 0.6500-4 |
Show 32 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libspreadsheet-parseexcel-perlDebian:10 |
before 0.6500-1+deb10u1, plus listed versions 0.6500-1 |
0.6500-1+deb10u1 |
libspreadsheet-parseexcel-perlDebian:11 |
before 0.6500-1.1+deb11u1, plus listed versions 0.6500-1.1 |
0.6500-1.1+deb11u1 |
perl-Spreadsheet-ParseExcelopenEuler:24.03-LTS |
before 0.65-2.oe2403 | 0.65-2.oe2403 |
perl-Spreadsheet-ParseExcelopenEuler:24.03-LTS-SP1 |
before 0.65-2.oe2403sp1 | 0.65-2.oe2403sp1 |
perl-Spreadsheet-ParseExcelopenEuler:24.03-LTS-SP2 |
before 0.65-2.oe2403sp2 | 0.65-2.oe2403sp2 |
gdataCRAN |
2.16.1 up to 3.0.0, plus listed versions 2.17.02.18.02.18.0.12.19.0 |
3.0.0 |
perl-Spreadsheet-ParseExcelSUSE:Linux Enterprise Module for Basesystem 15 SP5 |
before 0.65-150000.3.3.1 | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcelSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS |
before 0.65-150000.3.3.1 | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcelSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS |
before 0.65-150000.3.3.1 | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcelSUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS |
before 0.65-150000.3.3.1 | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcelSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 0.65-150000.3.3.1 | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcelSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 0.65-150000.3.3.1 | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcelSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 0.65-150000.3.3.1 | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcelSUSE:Linux Enterprise Real Time 15 SP4 |
before 0.65-150000.3.3.1 | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcelSUSE:Linux Enterprise Server 15 SP1-LTSS |
before 0.65-150000.3.3.1 | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcelSUSE:Linux Enterprise Server 15 SP2-LTSS |
before 0.65-150000.3.3.1 | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcelSUSE:Linux Enterprise Server 15 SP3-LTSS |
before 0.65-150000.3.3.1 | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcelSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 0.65-150000.3.3.1 | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcelSUSE:Linux Enterprise Server for SAP Applications 15 SP1 |
before 0.65-150000.3.3.1 | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcelSUSE:Linux Enterprise Server for SAP Applications 15 SP2 |
before 0.65-150000.3.3.1 | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcelSUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 0.65-150000.3.3.1 | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcelSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 0.65-150000.3.3.1 | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcelSUSE:Manager Proxy 4.3 |
before 0.65-150000.3.3.1 | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcelSUSE:Manager Server 4.3 |
before 0.65-150000.3.3.1 | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcelSUSE:Enterprise Storage 7.1 |
before 0.65-150000.3.3.1 | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcelopenSUSE:Leap 15.5 |
before 0.65-150000.3.3.1 | 0.65-150000.3.3.1 |
libspreadsheet-parseexcel-perlUbuntu:Pro:14.04:LTS |
before 0.5800-1ubuntu0.1~esm1, plus listed versions 0.5800-1 |
0.5800-1ubuntu0.1~esm1 |
libspreadsheet-parseexcel-perlUbuntu:Pro:16.04:LTS |
before 0.6500-1ubuntu0.16.04.1~esm1, plus listed versions 0.6500-1 |
0.6500-1ubuntu0.16.04.1~esm1 |
libspreadsheet-parseexcel-perlUbuntu:Pro:18.04:LTS |
before 0.6500-1ubuntu0.18.04.1~esm1, plus listed versions 0.6500-1 |
0.6500-1ubuntu0.18.04.1~esm1 |
libspreadsheet-parseexcel-perlUbuntu:20.04:LTS |
before 0.6500-1ubuntu0.20.04.1, plus listed versions 0.6500-1 |
0.6500-1ubuntu0.20.04.1 |
libspreadsheet-parseexcel-perlUbuntu:22.04:LTS |
before 0.6500-1.1ubuntu0.1, plus listed versions 0.6500-1.1 |
0.6500-1.1ubuntu0.1 |
perl-Spreadsheet-ParseExcelopenSUSE:Tumbleweed |
before 0.660.0-1.1 | 0.660.0-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Barracuda ESG Spreadsheet::ParseExcel Arbitrary Code Execution | 2023-12-24 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-7101 is a high vulnerability (CVSS 7.8) in Douglas Wilson Spreadsheet::parseexcel, published December 24, 2023. CISA lists it as known to be exploited, since January 2, 2024. EUVD reports exploitation since January 2, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 19.0%, the 97th percentile. Fixed in perl-spreadsheet-parseexcel 0.66-r0.
References
github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md
https//www.cve.org/CVERecord?id=CVE-2023-7101
openwall.com/lists/oss-security/2023/12/29/4
Show 23 moreShow less
lists.debian.org/debian-lts-announce/2023/12/msg00025.html
lists.fedoraproject.org/archives/list/[email protected]/message/IFEHKULQRVXHIV7XXK2RGD4VQN6Y4CV5
security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7101
nvd.nist.gov/vuln/detail/CVE-2023-7101
security.alpinelinux.org/vuln/CVE-2023-7101
security-tracker.debian.org/tracker/CVE-2023-7101
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-2507
suse.com/support/update/announcement/2024/suse-su-20240158-1
bugzilla.suse.com/1218414
ubuntu.com/security/CVE-2023-7101
cve.org/CVERecord?id=CVE-2023-7101