{"id":"CVE-2024-53924","aliases":["EUVD-2025-12282","GHSA-pw67-xjhq-389w","PYSEC-2025-177"],"status":"published","title":"Pycel allows code injection via a crafted formula","description":"Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IF(A1=200, eval(\"__import__('os').system( substring.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00983,"percentile":0.62739,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-94"],"published":"2025-04-17T00:00:00Z","modified":"2026-06-17T08:09:30Z","exploits":[{"source":"pocgithub","id":"aelmosalamy/CVE-2024-53924","title":"aelmosalamy/CVE-2024-53924","date":"2025-04-18","url":"https://github.com/aelmosalamy/CVE-2024-53924"}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pycel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0b30"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pycel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0b30"}]}],"versions":["1.0b0","1.0b11","1.0b12","1.0b13","1.0b14","1.0b15","1.0b16","1.0b17","1.0b18","1.0b19","1.0b2","1.0b20","1.0b21","1.0b22","1.0b26","1.0b27","1.0b28","1.0b29","1.0b3","1.0b30","1.0b4","1.0b5","1.0b6","1.0b7","1.0b8"]},{"source":"osv","ecosystem":"PyPI","package":"pycel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0-beta0"},{"last_affected":"1.0-beta11"},{"last_affected":"1.0-beta12"},{"last_affected":"1.0-beta13"},{"last_affected":"1.0-beta14"},{"last_affected":"1.0-beta15"},{"last_affected":"1.0-beta16"},{"last_affected":"1.0-beta17"},{"last_affected":"1.0-beta18"},{"last_affected":"1.0-beta19"},{"last_affected":"1.0-beta2"},{"last_affected":"1.0-beta20"},{"last_affected":"1.0-beta21"},{"last_affected":"1.0-beta22"},{"last_affected":"1.0-beta26"},{"last_affected":"1.0-beta27"},{"last_affected":"1.0-beta28"},{"last_affected":"1.0-beta29"},{"last_affected":"1.0-beta3"},{"last_affected":"1.0-beta30"},{"last_affected":"1.0-beta4"},{"last_affected":"1.0-beta5"},{"last_affected":"1.0-beta6"},{"last_affected":"1.0-beta7"},{"last_affected":"1.0-beta8"}]}],"versions":["1.0b0","1.0b11","1.0b12","1.0b13","1.0b14","1.0b15","1.0b16","1.0b17","1.0b18","1.0b19","1.0b2","1.0b20","1.0b21","1.0b22","1.0b26","1.0b27","1.0b28","1.0b29","1.0b3","1.0b30","1.0b4","1.0b5","1.0b6","1.0b7","1.0b8"]}],"products":[{"vendor":"dgorissen","product":"pycel"}],"references":[{"url":"https://pypi.org/project/pycel/","tags":["Product","package"]},{"url":"https://github.com/stephenrauch/pycel","tags":["Product","package"]},{"url":"https://github.com/dgorissen/pycel","tags":["Product","web","package"]},{"url":"https://gist.github.com/aelmosalamy/cb098e61939718d2bb248fd1cc94f287","tags":["exploit","Exploit","Third Party Advisory","web","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53924","tags":["advisory"]},{"url":"https://pypi.org/project/pycel","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pycel/PYSEC-2025-177.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pw67-xjhq-389w","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-53924","description":"Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IF(A1=200, eval(\"__import__('os').system( substring.","status":"published","published":"2025-04-17T00:00:00Z","modified":"2025-04-22T14:33:08.797Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:17.865042Z"}],"euvd":[{"id":"EUVD-2025-12282","description":"Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IF(A1=200, eval(\"__import__('os').system( substring.","status":"published","published":"2025-04-17T00:00:00Z","modified":"2025-04-22T14:33:08Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:17.280298Z"}],"ghsa":[{"id":"GHSA-pw67-xjhq-389w","title":"Pycel allows code injection via a crafted formula","description":"Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the `=IF(A1=200, eval(\"__import__('os').system(` substring.","status":"published","published":"2025-04-17T18:31:23Z","modified":"2026-06-08T19:04:28Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:40:18.682012Z"}],"nvd":[{"id":"CVE-2024-53924","description":"Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IF(A1=200, eval(\"__import__('os').system( substring.","status":"published","published":"2025-04-17T18:15:47.603Z","modified":"2026-06-17T08:09:30.563Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:10:46.40251Z"}],"osv":[{"id":"GHSA-pw67-xjhq-389w","title":"Pycel allows code injection via a crafted formula","description":"Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the `=IF(A1=200, eval(\"__import__('os').system(` substring.","status":"published","published":"2025-04-17T18:31:23Z","modified":"2026-06-08T19:15:12.476003987Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"PYSEC-2025-177","description":"Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IF(A1=200, eval(\"__import__('os').system( substring.","status":"published","published":"2025-04-17T18:15:47.603Z","modified":"2026-06-10T17:01:40.750882566Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:54.242332Z"}]}}