CVE-2023-7101 Spreadsheet::ParseExcel Remote Code Execution
An attacker can execute arbitrary code by crafting a malicious Excel file with specific number format strings, affecting applications using this Perl module.
- Exploited in the wild
- Since 2 Jan 2024
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-7101?
CVE-2023-7101 is a high-severity code injection vulnerability in Debian Debian Linux, published on 24 Dec 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
Which versions are affected by CVE-2023-7101?
1 open source package ship an affected version, including gdata. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
gdata CRAN | From 2.16.1 | 3.0.0 |
Linux distribution packages (21)
perl-Spreadsheet-ParseExcel SUSE:Enterprise Storage 7.1 | All versions | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcel SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcel SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcel SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS | All versions | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcel SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcel SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcel SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcel SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcel SUSE:Linux Enterprise Real Time 15 SP4 | All versions | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcel SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcel SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcel SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcel SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcel SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcel SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcel SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcel SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcel SUSE:Manager Proxy 4.3 | All versions | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcel SUSE:Manager Server 4.3 | All versions | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcel openSUSE:Leap 15.5 | All versions | 0.65-150000.3.3.1 |
perl-Spreadsheet-ParseExcel openSUSE:Tumbleweed | All versions | 0.660.0-1.1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Jmcnamara Spreadsheet\.
How do I fix CVE-2023-7101?
Upgrade gdata to 3.0.0 or later. US federal agencies must fix it by 23 Jan 2024.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-7101 being exploited?
Yes. Attackers have exploited CVE-2023-7101 in the wild since at least 2 Jan 2024.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2023-7101, DLA-3702-1, DSA-5592-1, GHSA-3c85-mx4x-435c, OESA-2025-2507, OESA-2025-2508 and 6 more.