EXPOSURES › CVE-2023-7101
CVE-2023-7101
HIGH ⌖ ON CISA KEV · EXPLOITEDSpreadsheet::ParseExcel allows remote code execution via unvalidated Excel file inputs.
This Perl module parses Excel files by passing unvalidated input directly into an eval function, enabling remote attackers to execute arbitrary code. DIB organizations must patch immediately as this is actively exploited and poses a direct threat to CMMC/NIST 800-171 compliance.
Shame score — The vulnerability stems from a common parsing flaw in third-party libraries rather than a deliberate security failure, though it remains a critical risk.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.