Critical Remote Code Execution Vulnerability in Spreadsheet::ParseExcel

What changed

A remote code execution vulnerability has been identified in the Spreadsheet::ParseExcel Perl module, specifically in version 0.65. This vulnerability arises from the handling of unvalidated input, which can lead to arbitrary code execution through the evaluation of Number format strings.

Who is affected

The vulnerability affects various users and applications that rely on the Spreadsheet::ParseExcel module for Excel file parsing. It is crucial for organizations to be aware of the potential risks associated with this flaw.

• Users of Spreadsheet::ParseExcel version 0.65.
• Developers utilizing the Perl module in their applications.
• Organizations that integrate Excel file processing in their workflows.
• Any system that processes untrusted Excel files using this module.

What to do

To mitigate the risks associated with this vulnerability, users should immediately evaluate their use of the affected module and consider updating to a patched version or implementing alternative solutions for Excel file parsing.

• Review and update to the latest version of Spreadsheet::ParseExcel if available.
• Implement input validation to mitigate the risk of arbitrary code execution.
• Consider using alternative libraries for Excel file parsing that do not exhibit this vulnerability.
• Monitor security advisories for updates related to this issue.