Bug#1152516: libspreadsheet-xlsx-perl: CVE-2026-115943

[Salvatore Bonaccorso]

Source: libspreadsheet-xlsx-perl
Version: 0.18-1
X-Debbugs-CC: team at security.debian.org
Severity: grave
Tags: security upstream

Hi,

The following vulnerability was published for libspreadsheet-xlsx-perl.

CVE-2026-115943[0]:
| Spreadsheet::XLSX versions before 0.19 for Perl allow code execution
| via string eval of number format conditions in ExcelFmt.  When a
| number format has a condition such as [>100], ExcelFmt chooses the
| format section by passing the condition and the cell value to a
| string eval. Both come from the workbook, and the eval runs while
| Spreadsheet::XLSX->new parses it.  An attacker who supplies an XLSX
| file can run arbitrary Perl code.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-115943
    https://www.cve.org/CVERecord?id=CVE-2026-115943
[1] https://lists.security.metacpan.org/cve-announce/msg/44746764/

Regards,
Salvatore