title: Arbitrary Code Execution (ACE) Vulnerability
description: Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
problem types: CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
affected:
{
collectionURL: https://metacpan.org/pod/Spreadsheet::ParseExcel
defaultStatus: affected
packageName: Spreadsheet::ParseExcel
product: Spreadsheet::ParseExcel
repo: https://metacpan.org/release/DOUGW/Spreadsheet-ParseExcel-0.65/source/lib/Spreadsheet
vendor: Douglas Wilson
versions:
status: affected, version: 0.65
}
solutions: Update to version 0.66