ZeroDay Findings
Sign inSign up

Findings

CVE-2023-7101

Spreadsheet::ParseExcel Remote Code Execution Vulnerability

Published Dec 24, 2023 · updated Jun 16, 2026 · jmcnamara spreadsheet

Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 24, 2023 · Catalog

    Detected

    Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing l

  2. Jan 2, 2024 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Jan 23, 2024 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing l

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Jan 23, 2024

Affected

  • cpe debian/debian linux10.0
  • cpe fedoraproject/fedora38
  • cpe fedoraproject/fedora39
  • cpe jmcnamara/spreadsheet\
  • vendor Spreadsheet::ParseExcel Spreadsheet::ParseExcelversion unspecified

Sources

  • CISA KEVCVE-2023-7101

    Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.

    cisa.gov
  • CVE.orgCVE-2023-7101

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2023-7101

    30-day exploitation probability 19.1%

    first.org
  • Metasploit Modulesexploit_linux/smtp/barracuda_esg_spreadsheet_rce

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2023-7101

    Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from

    nvd.nist.gov

References