{"history":[{"alert":0,"cve":"CVE-2023-7101","id":22618,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.18959, \"percentile\": 0.9734}"},{"alert":0,"cve":"CVE-2023-7101","id":20237,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.18959, \"percentile\": 0.97324}"},{"alert":0,"cve":"CVE-2023-7101","id":18206,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.18959, \"percentile\": 0.9732}"},{"alert":0,"cve":"CVE-2023-7101","id":16270,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.18959, \"percentile\": 0.97318}"},{"alert":0,"cve":"CVE-2023-7101","id":14248,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.18959, \"percentile\": 0.97317}"},{"alert":0,"cve":"CVE-2023-7101","id":12030,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.18959, \"percentile\": 0.97313}"},{"alert":0,"cve":"CVE-2023-7101","id":10016,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.18959, \"percentile\": 0.97311}"},{"alert":0,"cve":"CVE-2023-7101","id":7564,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.18959, \"percentile\": 0.9731}"},{"alert":1,"cve":"CVE-2023-7101","id":6178,"kind":"cna","observed_at":1793787601,"payload":"{\"containers\": {\"adp\": [{\"affected\": [{\"cpes\": [\"cpe:2.3:a:jmcnamara:spreadsheet\\\\:\\\\:parseexcel:0.41:*:*:*:*:perl:*:*\"], \"defaultStatus\": \"unknown\", \"product\": \"spreadsheet\\\\\", \"vendor\": \"jmcnamara\", \"versions\": [{\"lessThanOrEqual\": \"0.65\", \"status\": \"affected\", \"version\": \"0.41\", \"versionType\": \"custom\"}]}, {\"cpes\": [\"cpe:2.3:o:debian:debian_linux:10:*:*:*:*:*:*:*\"], \"defaultStatus\": \"unknown\", \"product\": \"debian_linux\", \"vendor\": \"debian\", \"versions\": [{\"status\": \"affected\", \"version\": \"10\"}]}, {\"cpes\": [\"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*\", \"cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*\"], \"defaultStatus\": \"unknown\", \"product\": \"fedora\", \"vendor\": \"fedoraproject\", \"versions\": [{\"status\": \"affected\", \"version\": \"38\"}, {\"status\": \"affected\", \"version\": \"39\"}]}, {\"cpes\": [\"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*\", \"cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*\"], \"defaultStatus\": \"unknown\", \"product\": \"fedora\", \"vendor\": \"fedoraproject\", \"versions\": [{\"status\": \"affected\", \"version\": \"38\"}, {\"status\": \"affected\", \"version\": \"39\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"LOCAL\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"REQUIRED\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}, {\"other\": {\"content\": {\"id\": \"CVE-2023-7101\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2025-08-20T03:56:14.026771Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2024-01-02\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7101\"}, \"type\": \"kev\"}}], \"providerMetadata\": {\"dateUpdated\": \"2025-10-21T23:05:29.481Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7101\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2024-01-02T00:00:00.000Z\", \"value\": \"CVE-2023-7101 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}, {\"providerMetadata\": {\"dateUpdated\": \"2024-08-02T08:50:08.227Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"tags\": [\"x_transferred\"], \"url\": \"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md\"}, {\"tags\": [\"x_transferred\"], \"url\": \"https://https://www.cve.org/CVERecord?id=CVE-2023-7101\"}, {\"tags\": [\"x_transferred\"], \"url\": \"https://https://metacpan.org/dist/Spreadsheet-ParseExcel\"}, {\"tags\": [\"x_transferred\"], \"url\": \"https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc\"}, {\"tags\": [\"x_transferred\"], \"url\": \"https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171\"}, {\"tags\": [\"x_transferred\"], \"url\": \"http://www.openwall.com/lists/oss-security/2023/12/29/4\"}, {\"tags\": [\"x_transferred\"], \"url\": \"https://lists.debian.org/debian-lts-announce/2023/12/msg00025.html\"}, {\"tags\": [\"x_transferred\"], \"url\": \"https://https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc\"}, {\"tags\": [\"x_transferred\"], \"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFEHKULQRVXHIV7XXK2RGD4VQN6Y4CV5/\"}, {\"tags\": [\"x_transferred\"], \"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2FIWDHRYTAAQLGM6AFOZVM7AFZ4H2ZR/\"}, {\"tags\": [\"x_transferred\"], \"url\": \"https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html\"}], \"title\": \"CVE Program Container\"}], \"cna\": {\"affected\": [{\"collectionURL\": \"https://metacpan.org/pod/Spreadsheet::ParseExcel\", \"defaultStatus\": \"affected\", \"packageName\": \"Spreadsheet::ParseExcel\", \"product\": \"Spreadsheet::ParseExcel\", \"repo\": \"https://metacpan.org/release/DOUGW/Spreadsheet-ParseExcel-0.65/source/lib/Spreadsheet\", \"vendor\": \"Douglas Wilson\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.65\"}]}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Le Dinh Hai (https://github.com/haile01/perl_spreadsheet_excel_rce_poc/tree/main)\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Barracuda Networks Inc.  https://www.barracuda.com/\"}], \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"<span style=\\\"background-color: transparent;\\\">Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary</span> <span style=\\\"background-color: transparent;\\\">code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type \\u201ceval\\u201d. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic. </span><br>\"}], \"value\": \"Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type \\u201ceval\\u201d. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.\"}], \"impacts\": [{\"capecId\": \"CAPEC-137\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-137: Parameter Injection\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-95\", \"description\": \"CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2024-05-05T14:52:28.089Z\", \"orgId\": \"027e81ed-0dd4-4685-ab4d-884aec5bb484\", \"shortName\": \"Mandiant\"}, \"references\": [{\"url\": \"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md\"}, {\"url\": \"https://https://www.cve.org/CVERecord?id=CVE-2023-7101\"}, {\"url\": \"https://https://metacpan.org/dist/Spreadsheet-ParseExcel\"}, {\"url\": \"https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc\"}, {\"url\": \"https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2023/12/29/4\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/12/msg00025.html\"}, {\"url\": \"https://https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFEHKULQRVXHIV7XXK2RGD4VQN6Y4CV5/\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2FIWDHRYTAAQLGM6AFOZVM7AFZ4H2ZR/\"}, {\"url\": \"https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html\"}], \"solutions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"Update to version 0.66<br>\"}], \"value\": \"Update to version 0.66\"}], \"source\": {\"discovery\": \"UNKNOWN\"}, \"title\": \"Arbitrary Code Execution (ACE) Vulnerability\", \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}}}, \"cveMetadata\": {\"assignerOrgId\": \"027e81ed-0dd4-4685-ab4d-884aec5bb484\", \"assignerShortName\": \"Mandiant\", \"cveId\": \"CVE-2023-7101\", \"datePublished\": \"2023-12-24T21:34:46.527Z\", \"dateReserved\": \"2023-12-24T16:23:02.000Z\", \"dateUpdated\": \"2025-10-21T23:05:29.481Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.1\"}"},{"alert":0,"cve":"CVE-2023-7101","id":5341,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.18959, \"percentile\": 0.97304}"},{"alert":0,"cve":"CVE-2023-7101","id":3123,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.18959, \"percentile\": 0.973}"},{"alert":1,"cve":"CVE-2023-7101","id":712,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2023-7101\", \"cwes\": [\"CWE-95\"], \"dateAdded\": \"2024-01-02\", \"dueDate\": \"2024-01-23\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Unknown\", \"notes\": \"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://metacpan.org/dist/Spreadsheet-ParseExcel and Barracuda's specific implementation and fix for their downstream issue CVE-2023-7102 at https://www.barracuda.com/company/legal/esg-vulnerability;  https://nvd.nist.gov/vuln/detail/CVE-2023-7101\", \"product\": \"Spreadsheet::ParseExcel\", \"requiredAction\": \"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\", \"shortDescription\": \"Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type \\u201ceval\\u201d. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.\", \"vendorProject\": \"Spreadsheet::ParseExcel\", \"vulnerabilityName\": \"Spreadsheet::ParseExcel Remote Code Execution Vulnerability\"}"}],"record":{"affected":[{"collectionURL":"https://metacpan.org/pod/Spreadsheet::ParseExcel","defaultStatus":"affected","packageName":"Spreadsheet::ParseExcel","product":"Spreadsheet::ParseExcel","repo":"https://metacpan.org/release/DOUGW/Spreadsheet-ParseExcel-0.65/source/lib/Spreadsheet","vendor":"Douglas Wilson","versions":[{"status":"affected","version":"0.65"}]}],"cna":{"containers":{"adp":[{"affected":[{"cpes":["cpe:2.3:a:jmcnamara:spreadsheet\\:\\:parseexcel:0.41:*:*:*:*:perl:*:*"],"defaultStatus":"unknown","product":"spreadsheet\\","vendor":"jmcnamara","versions":[{"lessThanOrEqual":"0.65","status":"affected","version":"0.41","versionType":"custom"}]},{"cpes":["cpe:2.3:o:debian:debian_linux:10:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"debian_linux","vendor":"debian","versions":[{"status":"affected","version":"10"}]},{"cpes":["cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"fedora","vendor":"fedoraproject","versions":[{"status":"affected","version":"38"},{"status":"affected","version":"39"}]},{"cpes":["cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"fedora","vendor":"fedoraproject","versions":[{"status":"affected","version":"38"},{"status":"affected","version":"39"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}},{"other":{"content":{"id":"CVE-2023-7101","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2025-08-20T03:56:14.026771Z","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2024-01-02","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7101"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2025-10-21T23:05:29.481Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7101"}],"timeline":[{"lang":"en","time":"2024-01-02T00:00:00.000Z","value":"CVE-2023-7101 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2024-08-02T08:50:08.227Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_transferred"],"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md"},{"tags":["x_transferred"],"url":"https://https://www.cve.org/CVERecord?id=CVE-2023-7101"},{"tags":["x_transferred"],"url":"https://https://metacpan.org/dist/Spreadsheet-ParseExcel"},{"tags":["x_transferred"],"url":"https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc"},{"tags":["x_transferred"],"url":"https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171"},{"tags":["x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2023/12/29/4"},{"tags":["x_transferred"],"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00025.html"},{"tags":["x_transferred"],"url":"https://https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc"},{"tags":["x_transferred"],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFEHKULQRVXHIV7XXK2RGD4VQN6Y4CV5/"},{"tags":["x_transferred"],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2FIWDHRYTAAQLGM6AFOZVM7AFZ4H2ZR/"},{"tags":["x_transferred"],"url":"https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"collectionURL":"https://metacpan.org/pod/Spreadsheet::ParseExcel","defaultStatus":"affected","packageName":"Spreadsheet::ParseExcel","product":"Spreadsheet::ParseExcel","repo":"https://metacpan.org/release/DOUGW/Spreadsheet-ParseExcel-0.65/source/lib/Spreadsheet","vendor":"Douglas Wilson","versions":[{"status":"affected","version":"0.65"}]}],"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Le Dinh Hai (https://github.com/haile01/perl_spreadsheet_excel_rce_poc/tree/main)"},{"lang":"en","type":"reporter","user":"00000000-0000-4000-9000-000000000000","value":"Barracuda Networks Inc.  https://www.barracuda.com/"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: transparent;\">Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary</span> <span style=\"background-color: transparent;\">code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type \u201ceval\u201d. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic. </span><br>"}],"value":"Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type \u201ceval\u201d. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic."}],"impacts":[{"capecId":"CAPEC-137","descriptions":[{"lang":"en","value":"CAPEC-137: Parameter Injection"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-95","description":"CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2024-05-05T14:52:28.089Z","orgId":"027e81ed-0dd4-4685-ab4d-884aec5bb484","shortName":"Mandiant"},"references":[{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md"},{"url":"https://https://www.cve.org/CVERecord?id=CVE-2023-7101"},{"url":"https://https://metacpan.org/dist/Spreadsheet-ParseExcel"},{"url":"https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc"},{"url":"https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171"},{"url":"http://www.openwall.com/lists/oss-security/2023/12/29/4"},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00025.html"},{"url":"https://https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFEHKULQRVXHIV7XXK2RGD4VQN6Y4CV5/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2FIWDHRYTAAQLGM6AFOZVM7AFZ4H2ZR/"},{"url":"https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update to version 0.66<br>"}],"value":"Update to version 0.66"}],"source":{"discovery":"UNKNOWN"},"title":"Arbitrary Code Execution (ACE) Vulnerability","x_generator":{"engine":"Vulnogram 0.1.0-dev"}}},"cveMetadata":{"assignerOrgId":"027e81ed-0dd4-4685-ab4d-884aec5bb484","assignerShortName":"Mandiant","cveId":"CVE-2023-7101","datePublished":"2023-12-24T21:34:46.527Z","dateReserved":"2023-12-24T16:23:02.000Z","dateUpdated":"2025-10-21T23:05:29.481Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"cna_checked":1794241201,"cve":"CVE-2023-7101","description":"Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type \u201ceval\u201d. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.","epss":{"date":"2026-11-12","epss":0.18959,"percentile":0.9734},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2023-7101","cwes":["CWE-95"],"dateAdded":"2024-01-02","dueDate":"2024-01-23","forensicTriage":"No","knownRansomwareCampaignUse":"Unknown","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://metacpan.org/dist/Spreadsheet-ParseExcel and Barracuda's specific implementation and fix for their downstream issue CVE-2023-7102 at https://www.barracuda.com/company/legal/esg-vulnerability;  https://nvd.nist.gov/vuln/detail/CVE-2023-7101","product":"Spreadsheet::ParseExcel","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","shortDescription":"Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type \u201ceval\u201d. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.","vendorProject":"Spreadsheet::ParseExcel","vulnerabilityName":"Spreadsheet::ParseExcel Remote Code Execution Vulnerability"},"kev_checked":1794522003,"products":"Douglas Wilson Spreadsheet::ParseExcel","references":["https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md","https://https://www.cve.org/CVERecord?id=CVE-2023-7101","https://https://metacpan.org/dist/Spreadsheet-ParseExcel","https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc","https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171","http://www.openwall.com/lists/oss-security/2023/12/29/4","https://lists.debian.org/debian-lts-announce/2023/12/msg00025.html","https://https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFEHKULQRVXHIV7XXK2RGD4VQN6Y4CV5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2FIWDHRYTAAQLGM6AFOZVM7AFZ4H2ZR/","https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7101"],"score":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"CISA-ADP","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"solutions":"Update to version 0.66","state":"PUBLISHED","title":"Arbitrary Code Execution (ACE) Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[]}