Spreadsheet::XLSX before version 0.19 processes custom Excel number format conditions by passing the condition string and the cell value to Perl's string eval function during parsing. Because both the condition and the cell value originate from the workbook, an attacker can craft an XLSX file that contains malicious code embedded within a number format condition. When Spreadsheet::XLSX parses the workbook, the eval executes that code with full privileges of the running Perl process, allowing arbitrary Perl code execution.

The vulnerability affects the Perl module Spreadsheet::XLSX, specifically versions earlier than 0.19. Any Perl application that loads a legacy Spreadsheet::XLSX library and processes user‑supplied XLSX files is susceptible. Systems using newer releases (0.19 or later) are not impacted.

The flaw provides a remote code execution when an attacker can supply a crafted XLSX file to the application. The exploit requires only that the application load the old library while parsing an input file; no additional network authentication is necessary. No exploit probability is available in EPSS, and the vulnerability is not listed in CISA's KEV catalog, but the nature of the flaw and the lack of a guard around eval mean the risk is high. Official advice is to patch immediately.