PT-2023-8146 · Unknown+4 · Spreadsheet::Parseexcel+4
Đình Hải Lê
+1
·
Published
2023-12-21
·
Updated
2025-10-31
·
CVE-2023-7101
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Spreadsheet::ParseExcel version 0.65
Description
The issue is related to the evaluation of Number format strings within the Excel parsing logic, which allows for arbitrary code execution due to passing unvalidated input from a file into a string-type
eval. This vulnerability can be exploited when processing XLS or XLSX files that include specially crafted number formatting rules. The problem is caused by the use of data from the processed file when building the eval call.Recommendations
For Spreadsheet::ParseExcel version 0.65, upgrade to version 0.66 to fix the issue. As a temporary workaround, consider disabling the use of Number format strings within the Excel parsing logic until a patch is available. Restrict access to the
eval function to minimize the risk of exploitation. Avoid using the eval function with unvalidated input from files.Exploit
Fix
Code Injection
Eval Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Linuxmint
Spreadsheet::Parseexcel
Suse
Ubuntu