CVE-2023-7101: Spreadsheet::ParseExcel Remote Code Execution Vulnerability

CVE-2023-7101 is a remote code execution vulnerability in the Spreadsheet::ParseExcel Perl module. It arises when the library processes a crafted Excel file and evaluates untrusted data as code. Systems or scripts that parse untrusted spreadsheets with this module can be fully compromised if the running process has sufficient privileges.

Defenders should treat any use of Spreadsheet::ParseExcel for handling external or user-supplied Excel files as high priority until the issue is confirmed remediated against the vendor advisory. The CISA required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

How it works

The flaw is classified as CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code, commonly called eval injection). Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.

An attacker supplies a malicious Excel file whose number-format data is later fed into an eval operation. Because the input is not properly sanitized, the eval can execute arbitrary code in the context of the process that is parsing the file. No further user interaction is required beyond the act of parsing the file. Exact exploit mechanics and any version-specific triggers must be confirmed against the vendor advisory; public detail beyond the CWE and CISA summary is limited.

Am I affected? How to find it in your systems

Spreadsheet::ParseExcel is a Perl module commonly used by data-import scripts, backend services, reporting tools, and any application that needs to read classic Excel (.xls) files. It may appear as a direct dependency or as a transitive dependency of larger Perl packages.

• Inventory Perl environments (system Perl, containers, application servers, CI runners) and list installed modules with the local package manager or cpan/cpanm tools. Search for the string Spreadsheet::ParseExcel.
• Review application code and configuration for any call sites that open or parse Excel files from untrusted sources (uploads, email attachments, network shares).
• Check software bills of materials and dependency lock files for the module name.
• Confirm the exact installed version and whether it is still vulnerable by comparing it with the fixed version listed in the vendor advisory; do not rely on version numbers stated elsewhere.

Telemetry signs of exploitation are those typical of eval-based code execution: unexpected child processes spawned by the Perl interpreter, anomalous network connections originating from a spreadsheet-parsing process, or crash dumps and error logs that mention eval or number-format handling. Because the attack is file-driven, also look for recently processed Excel files that originated outside the organization.

How to remediate

Patch first. Apply the vendor-supplied update for Spreadsheet::ParseExcel exactly as described in the official advisory. After installation, re-inventory to verify the vulnerable module is no longer present.

Once the patch is applied, harden the surrounding environment against this class of flaw:

• Prefer safer parsing libraries that do not evaluate format strings as code.
• Reject or quarantine Excel files from untrusted sources before they reach any parser.
• Run parsing processes under least privilege and, where feasible, inside a sandbox or container with no network access and a read-only filesystem.
• Disable or remove any unused Excel-parsing functionality.

If the product cannot be updated, follow the CISA guidance and discontinue its use.

If you can't patch immediately

Implement compensating controls while a permanent fix is prepared:

• Network segmentation: isolate hosts that must still parse Excel files so that successful code execution cannot reach high-value assets.
• Virtual patching or WAF rules: if the parser is reached via a web front-end, block or detonate uploaded Excel files before they are handed to Spreadsheet::ParseExcel.
• Feature disablement: temporarily turn off any upload or import path that feeds Excel files into the vulnerable module.
• Enhanced monitoring: alert on process creation, unexpected outbound connections, or file-system modifications originating from Perl processes that handle spreadsheets. Retain copies of all ingested Excel files for later forensic review.

These measures reduce risk but do not eliminate it; schedule the vendor update or product replacement as soon as possible.

If your data may have been exposed

Successful exploitation of a remote-code-execution flaw can lead to full host compromise and subsequent data theft or ransomware deployment. Known ransomware use of this specific CVE is not documented. If you believe an untrusted Excel file was processed by a vulnerable instance, treat the host as potentially breached: isolate it, collect forensic images, and rotate credentials that may have been accessible to the process. You can also run a free exposure scan of your email addresses against known breach data to determine whether any of your accounts already appear in public dumps.