Vulnerability Intelligence Report
Arbitrary Code Execution (ACE) Vulnerability
CVE-2023-7101
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
CISA KEV
SSVC: Active Exploitation
CVSS Base Score
7.8
HIGH
Exploitability:1.9
Impact Score:5.9
EPSS Probability:16.70%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-95 ↗CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Douglas Wilson | Spreadsheet::ParseExcel | 0.65 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Mandiant Inc. · Researcher · USA |
| Reserved | 2023-12-24T16:23:02 |
| Published | 2023-12-24T21:34:46 |
| Last Updated | 2025-10-21T23:05:29 |
Community Chatter & Buzz