CVE-2023-7101

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Spreadsheet::ParseExcel version 0.65 is a Perl module for parsing Excel files that contains an arbitrary code execution vulnerability. The flaw arises when unvalidated Number format strings from an input file are passed directly into a string-type eval call within the parsing logic, enabling injection of Perl code. The issue is tracked under CWE-95 and CWE-94 and carries a CVSS 3.1 score of 7.8 reflecting local access, low attack complexity, no privileges required, and user interaction via a malicious file.

An attacker can supply a crafted Excel document that, when opened or processed by an application using the vulnerable module, executes arbitrary Perl code under the privileges of the calling process. Successful exploitation yields full control over confidentiality, integrity, and availability on the affected system.

Public references point to a fix committed in the upstream repository that sanitizes format strings before evaluation. Additional disclosures from Mandiant and oss-security lists describe the same root cause and recommend upgrading to a patched release once available.

EPSS for the CVE rose from lower values after disclosure to a peak of 0.8590 on 2025-12-11 before receding to the current 0.5779, indicating that exploitation interest increased measurably in the months following publication.