{"id":"CVE-2023-7101","aliases":["ALPINE-CVE-2023-7101","DEBIAN-CVE-2023-7101","DLA-3702-1","DSA-5592-1","EUVD-2023-59285","GHSA-3c85-mx4x-435c","OESA-2025-2507","OESA-2025-2508","OESA-2025-2613","RSEC-2023-9","SUSE-SU-2024:0158-1","UBUNTU-CVE-2023-7101","USN-6781-1","openSUSE-SU-2024:13558-1"],"status":"published","title":"Arbitrary Code Execution (ACE) Vulnerability","description":"Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.18959,"percentile":0.97318,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-94","CWE-95"],"published":"2023-12-24T21:34:46Z","modified":"2026-11-03T06:32:44Z","kev":{"date_added":"2024-01-02","due_date":"2024-01-23","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2024-01-02"},{"source":"kev","since":"2024-01-02"}],"exploits":[{"source":"metasploit","id":"exploit/linux/smtp/barracuda_esg_spreadsheet_rce","title":"Barracuda ESG Spreadsheet::ParseExcel Arbitrary Code Execution","type":"exploit","platform":"Unix","date":"2023-12-24","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/smtp/barracuda_esg_spreadsheet_rce"}],"fixes":[{"ecosystem":"Alpine:v3.18","package":"perl-spreadsheet-parseexcel","fixed_in":["0.66-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"perl-spreadsheet-parseexcel","fixed_in":["0.66-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"perl-spreadsheet-parseexcel","fixed_in":["0.66-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"perl-spreadsheet-parseexcel","fixed_in":["0.66-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"perl-spreadsheet-parseexcel","fixed_in":["0.66-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"perl-spreadsheet-parseexcel","fixed_in":["0.66-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"perl-spreadsheet-parseexcel","fixed_in":["0.66-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libspreadsheet-parseexcel-perl","fixed_in":["0.6500-4~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libspreadsheet-parseexcel-perl","fixed_in":["0.6500-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libspreadsheet-parseexcel-perl","fixed_in":["0.6500-4"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"libspreadsheet-parseexcel-perl","fixed_in":["0.6500-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"libspreadsheet-parseexcel-perl","fixed_in":["0.6500-1.1+deb11u1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-2.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-2.oe2403sp2"],"sources":["osv"]},{"ecosystem":"CRAN","package":"gdata","fixed_in":["3.0.0"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP4","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.65-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libspreadsheet-parseexcel-perl","fixed_in":["0.5800-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libspreadsheet-parseexcel-perl","fixed_in":["0.6500-1ubuntu0.16.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libspreadsheet-parseexcel-perl","fixed_in":["0.6500-1ubuntu0.18.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libspreadsheet-parseexcel-perl","fixed_in":["0.6500-1ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libspreadsheet-parseexcel-perl","fixed_in":["0.6500-1.1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-Spreadsheet-ParseExcel","fixed_in":["0.660.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"perl-spreadsheet-parseexcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.66-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"perl-spreadsheet-parseexcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.66-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"perl-spreadsheet-parseexcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.66-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"perl-spreadsheet-parseexcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.66-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"perl-spreadsheet-parseexcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.66-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"perl-spreadsheet-parseexcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.66-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"perl-spreadsheet-parseexcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.66-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libspreadsheet-parseexcel-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6500-4~deb12u1"}]}],"versions":["0.6500-3"]},{"source":"osv","ecosystem":"Debian:13","package":"libspreadsheet-parseexcel-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6500-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libspreadsheet-parseexcel-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6500-4"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"libspreadsheet-parseexcel-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6500-1+deb10u1"}]}],"versions":["0.6500-1"]},{"source":"osv","ecosystem":"Debian:11","package":"libspreadsheet-parseexcel-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6500-1.1+deb11u1"}]}],"versions":["0.6500-1.1"]},{"source":"osv","ecosystem":"Debian:12","package":"libspreadsheet-parseexcel-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6500-4~deb12u1"}]}],"versions":["0.6500-3"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-2.oe2403sp2"}]}]},{"source":"osv","ecosystem":"CRAN","package":"gdata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.1"},{"fixed":"3.0.0"}]}],"versions":["2.16.1","2.17.0","2.18.0","2.18.0.1","2.19.0"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP4","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.65-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libspreadsheet-parseexcel-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5800-1ubuntu0.1~esm1"}]}],"versions":["0.5800-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libspreadsheet-parseexcel-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6500-1ubuntu0.16.04.1~esm1"}]}],"versions":["0.6500-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libspreadsheet-parseexcel-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6500-1ubuntu0.18.04.1~esm1"}]}],"versions":["0.6500-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libspreadsheet-parseexcel-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6500-1ubuntu0.20.04.1"}]}],"versions":["0.6500-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libspreadsheet-parseexcel-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6500-1.1ubuntu0.1"}]}],"versions":["0.6500-1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libspreadsheet-parseexcel-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5800-1ubuntu0.1~esm1"}]}],"versions":["0.5800-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libspreadsheet-parseexcel-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6500-1ubuntu0.16.04.1~esm1"}]}],"versions":["0.6500-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libspreadsheet-parseexcel-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6500-1ubuntu0.18.04.1~esm1"}]}],"versions":["0.6500-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libspreadsheet-parseexcel-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6500-1ubuntu0.20.04.1"}]}],"versions":["0.6500-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libspreadsheet-parseexcel-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6500-1.1ubuntu0.1"}]}],"versions":["0.6500-1.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Spreadsheet-ParseExcel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.660.0-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"douglas wilson","product":"spreadsheet::parseexcel"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"jmcnamara","product":"spreadsheet\\"},{"vendor":"spreadsheet::parseexcel","product":"spreadsheet::parseexcel"}],"references":[{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md","tags":["x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://https://www.cve.org/CVERecord?id=CVE-2023-7101","tags":["x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"https://https://metacpan.org/dist/Spreadsheet-ParseExcel","tags":["x_transferred","Broken Link","Product","web"]},{"url":"https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc","tags":["x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171","tags":["x_transferred","Product","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/12/29/4","tags":["x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00025.html","tags":["x_transferred","Mailing List","article"]},{"url":"https://https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc","tags":["x_transferred","Broken Link","Patch","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFEHKULQRVXHIV7XXK2RGD4VQN6Y4CV5/","tags":["x_transferred","Broken Link","Mailing List","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2FIWDHRYTAAQLGM6AFOZVM7AFZ4H2ZR/","tags":["x_transferred","Broken Link","Mailing List","article"]},{"url":"https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7101","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-7101","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFEHKULQRVXHIV7XXK2RGD4VQN6Y4CV5"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2FIWDHRYTAAQLGM6AFOZVM7AFZ4H2ZR"},{"url":"https://github.com/advisories/GHSA-3c85-mx4x-435c"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-7101","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-7101","tags":["advisory","web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2507","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2508","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2613","tags":["advisory"]},{"url":"https://github.com/r-gregmisc/gdata/issues/14","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240158-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218414","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-7101","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-7101","tags":["report"]},{"url":"https://github.com/haile01/perl_spreadsheet_excel_rce_poc","tags":["report"]},{"url":"https://github.com/runrig/spreadsheet-parseexcel/issues/33","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-7101","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6781-1","tags":["advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-7101","title":"Arbitrary Code Execution (ACE) Vulnerability","description":"Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.","status":"published","published":"2023-12-24T21:34:46.527Z","modified":"2025-10-21T23:05:29.481Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-95"],"updated_at":"2026-11-02T14:35:34.170609Z"}],"euvd":[{"id":"EUVD-2023-59285","description":"Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.","status":"published","published":"2023-12-24T21:34:46Z","modified":"2025-10-21T23:05:29Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2024-01-02","updated_at":"2026-11-02T20:31:27.312976Z"}],"ghsa":[{"id":"GHSA-3c85-mx4x-435c","title":"Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet:...","description":"Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.","status":"published","published":"2023-12-25T00:30:17Z","modified":"2025-10-22T00:34:01Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94","CWE-95"],"updated_at":"2026-11-02T15:04:08.734574Z"}],"kev":[{"id":"CVE-2023-7101","title":"Spreadsheet::ParseExcel Remote Code Execution Vulnerability","description":"Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.","cwes":["CWE-95"],"kev":{"date_added":"2024-01-02","due_date":"2024-01-23","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2023-7101","description":"Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.","status":"published","published":"2023-12-24T22:15:07.983Z","modified":"2026-06-17T06:52:04.04Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-95","CWE-94"],"updated_at":"2026-11-02T14:08:57.117371Z"}],"osv":[{"id":"ALPINE-CVE-2023-7101","description":"Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.","status":"published","published":"2023-12-24T22:15:07.983Z","modified":"2026-11-03T06:32:44.36952248Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"CVE-2023-7101","description":"Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.","status":"published","published":"2023-12-24T22:15:07.983Z","modified":"2026-03-15T22:48:01.794334Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:37.180532Z"},{"id":"DEBIAN-CVE-2023-7101","description":"Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.","status":"published","published":"2023-12-24T22:15:07.983Z","modified":"2026-10-26T18:02:45.689883367Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:41.533064Z"},{"id":"OESA-2025-2507","title":"perl-Spreadsheet-ParseExcel security update","description":"The Spreadsheet::ParseExcel module can be used to read information from an Excel 95-2003 file.\r\n\r\nSecurity Fix(es):\n\nSpreadsheet::ParseExcel version 0.65, a Perl module for parsing Excel files, is vulnerable to arbitrary code execution (ACE) due to passing unvalidated input from a file into a string-type eval. The issue specifically arises from the evaluation of Number format strings (distinct from printf-style format strings) within the Excel parsing logic.(CVE-2023-7101)","status":"published","published":"2025-10-24T11:09:36Z","modified":"2026-08-18T01:19:15.763004059Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2508","title":"perl-Spreadsheet-ParseExcel security update","description":"The Spreadsheet::ParseExcel module can be used to read information from an Excel 95-2003 file.\r\n\r\nSecurity Fix(es):\n\nSpreadsheet::ParseExcel version 0.65, a Perl module for parsing Excel files, is vulnerable to arbitrary code execution (ACE) due to passing unvalidated input from a file into a string-type eval. The issue specifically arises from the evaluation of Number format strings (distinct from printf-style format strings) within the Excel parsing logic.(CVE-2023-7101)","status":"published","published":"2025-10-24T11:09:36Z","modified":"2026-08-18T01:19:15.707305946Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2613","title":"perl-Spreadsheet-ParseExcel security update","description":"The Spreadsheet::ParseExcel module can be used to read information from an Excel 95-2003 file.\r\n\r\nSecurity Fix(es):\n\nSpreadsheet::ParseExcel version 0.65, a Perl module for parsing Excel files, is vulnerable to arbitrary code execution (ACE) due to passing unvalidated input from a file into a string-type eval. The issue specifically arises from the evaluation of Number format strings (distinct from printf-style format strings) within the Excel parsing logic.(CVE-2023-7101)","status":"published","published":"2025-10-31T11:09:44Z","modified":"2026-08-18T01:19:17.607288562Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"UBUNTU-CVE-2023-7101","description":"Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.","status":"published","published":"2023-12-24T22:15:00Z","modified":"2026-02-04T03:11:31.463031Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"DLA-3702-1","title":"libspreadsheet-parseexcel-perl - security update","status":"published","published":"2023-12-31T00:00:00Z","modified":"2026-03-09T01:22:30.923657Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5592-1","title":"libspreadsheet-parseexcel-perl - security update","status":"published","published":"2023-12-30T00:00:00Z","modified":"2026-03-09T02:08:30.548916Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"openSUSE-SU-2024:13558-1","title":"perl-Spreadsheet-ParseExcel-0.660.0-1.1 on GA media","description":"These are all security issues fixed in the perl-Spreadsheet-ParseExcel-0.660.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:46:36.931163Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"RSEC-2023-9","title":"Arbitrary Code Execution (ACE) Vulnerability","description":"Bundled Perl script Spreadsheet::ParseExcel version 0.65 is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type \"eval\". Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic. Fixed with the depreation of Excel-related functionality from gdata version 3.0.0 -- upgrading advised.","status":"published","published":"2025-05-16T00:12:44Z","modified":"2025-05-19T19:43:48.455096Z","updated_at":"2026-11-02T15:53:39.492624Z"},{"id":"SUSE-SU-2024:0158-1","title":"Security update for perl-Spreadsheet-ParseExcel","description":"This update for perl-Spreadsheet-ParseExcel fixes the following issues:\n\n- CVE-2023-7101: Fixed a command injection issue when parsing an\n  untrusted spreadsheet (bsc#1218414).\n","status":"published","published":"2024-01-18T16:03:34Z","modified":"2026-02-04T03:34:19.761263Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"USN-6781-1","title":"libspreadsheet-parseexcel-perl vulnerability","description":"Le Dinh Hai discovered that Spreadsheet::ParseExcel was passing unvalidated \ninput from a file into a string-type \"eval\". An attacker could craft a \nmalicious file to achieve arbitrary code execution.\n","status":"published","published":"2024-05-21T13:21:26Z","modified":"2026-06-29T13:51:10.062837821Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}