CVE-2023-7101: Spreadsheet::ParseExcel Perl module code injection via Excel number format strings

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe vulnerability allows arbitrary code execution, is listed in CISA KEV with a near-term remediation deadline, and has high EPSS probability, though it requires user interaction to trigger.

What it is

Spreadsheet::ParseExcel 0.65, a Perl module for parsing Excel files, passes unvalidated input from a file into a string-type eval. Specifically, Number format strings within the Excel parsing logic are evaluated, allowing arbitrary Perl code execution. This matters because parsing an untrusted spreadsheet can run attacker-controlled code in the context of the application using the module.

Impact

An attacker gains arbitrary code execution with the privileges of the process parsing the Excel file. This can lead to full compromise of the host or application, including data theft, persistence, and lateral movement.

Attack surface

The flaw is reached by supplying a crafted Excel file to an application that uses Spreadsheet::ParseExcel to parse it. The CVSS vector AV:L/PR:N/UI:R indicates local access with no privileges but requires user interaction, meaning a victim must open or process the malicious file.

Exploitation

CVE-2023-7101 is listed in CISA KEV with a due date of 2024-01-23, and EPSS shows a 30-day probability of 0.19106 (97th percentile). References include a proof-of-concept link and patch commits, indicating public exploit code and active exploitation risk.

What to do

• Upgrade Spreadsheet::ParseExcel to a patched version; apply the vendor commit or distribution update referenced in the advisory.
• Update Debian and Fedora packages to the fixed versions announced in their respective security lists.
• If patching is not possible, discontinue use of Spreadsheet::ParseExcel for untrusted files or isolate parsing in a sandbox with minimal privileges.
• Avoid processing Excel files from untrusted sources with applications that rely on this module until remediation is complete.

Detection

• Monitor for unexpected child processes or command execution originating from Perl processes that parse Excel files.
• Inspect Excel files for anomalous Number format strings containing Perl code or eval-like constructs before parsing.
• Audit application logs for errors or unusual behavior when Spreadsheet::ParseExcel processes external spreadsheets.
• Use file integrity monitoring on Perl module files and watch for unauthorized changes to Spreadsheet::ParseExcel.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.