Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade perl-spreadsheet-parseexcel | Aug 22, 2024 | Dec 24, 2023 |
| Amazon_linux | — | Upgrade perl-Spreadsheet-ParseExcel | Jan 24, 2024 | Dec 24, 2023 |
| Amazon_linux_2023 | — | Upgrade perl-Spreadsheet-ParseExcel | Feb 17, 2025 | Dec 24, 2023 |
| Debian | — | Upgrade libspreadsheet-parseexcel-perl | Jan 8, 2024 | Dec 24, 2023 |
| Freebsd | — | Upgrade p5-Spreadsheet-ParseExcel | Feb 12, 2024 | Feb 11, 2024 |
| Gentoo Linux | — | Upgrade dev-perl/Spreadsheet-ParseExcel. | Aug 7, 2025 | Aug 6, 2025 |
| Suse | — | Upgrade perl-Spreadsheet-ParseExcel | Jan 19, 2024 | Dec 24, 2023 |
| Ubuntu | — | Upgrade libspreadsheet-parseexcel-perlUpgrade libspreadsheet-parseexcel-perl (Ubuntu Pro) | May 28, 2024 | Dec 24, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub
