January 2, 2024 · Applied Cybernetics Group
CVE-2023-7101 — Spreadsheet::ParseExcel Spreadsheet::ParseExcel
Spreadsheet::ParseExcel Remote Code Execution Vulnerability
- Added to KEV
2024-01-02- Federal due date
2024-01-23- Vendor
- Spreadsheet::ParseExcel
- Product
- Spreadsheet::ParseExcel
- EPSS
- 96.7th percentile (score 0.168, as of
2026-07-13) - NVD CVSS v3.1
- —
- Ransomware use
- Unknown
- ATT&CK
- T1059 , T1105 , T1190 · signal rollup
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2023-7101
CISA short description
Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.