Cyber ·
CVE-2026-115943: code execution in Spreadsheet::XLSX for Perl before version 0.19
CPAN Security Group advisory describes code execution in Spreadsheet::XLSX for Perl versions before 0.19, through eval applied to numeric format conditions in the ExcelFmt module.
The CPAN Security Group published advisory CVE-2026-115943 for the Spreadsheet-XLSX distribution, used in Perl. According to the text, versions before 0.19 allow code execution through eval applied to numeric format conditions in the ExcelFmt module. The material was relayed through the oss-sec feed, with a date of October 29, 2026 and a publication record of October 30, 2026. Version 0.19 is the first indicated as not affected. To consult the original, access the advisory through the addresses listed in the source text, including the oss-sec list message and the distribution pages on MetaCPAN and the code repository. The provided text includes no description of exploitation, severity score or mitigation beyond the version indication, so confirm these points at the source before deciding.