Description
The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the no_xxe option of XML::Twig.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libspreadsheet-parsexlsx-perl | 0.31-1 | — |
| Debian 13 | libspreadsheet-parsexlsx-perl | 0.31-1 | — |
| Debian 12 | libspreadsheet-parsexlsx-perl | 0.27-3+deb12u2 | — |
| Debian 10 | libspreadsheet-parsexlsx-perl | 0.27-2+deb10u1 | DLA-3723-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | libspreadsheet-parsexlsx-perl | 0.27-2.1+deb11u2build0.22.04.1 | USN-6769-1 |
| Ubuntu 20.04 LTS | libspreadsheet-parsexlsx-perl | 0.27-2+deb10u1build0.20.04.1 | USN-6769-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | perl-Spreadsheet-ParseXLSX | 0.310.0-1.1 | openSUSE-SU-2024:13760-1 |
Advisories 3
- DLA-3723-1 libspreadsheet-parsexlsx-perl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-6769-1 libspreadsheet-parsexlsx-perl vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:13760-1 perl-Spreadsheet-ParseXLSX-0.310.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- https://metacpan.org/release/NUDDLEGG/Spreadsheet-ParseXLSX-0.30/changes
- https://gist.github.com/phvietan/d1c95a88ab6e17047b0248d6bf9eac4a
- https://github.com/MichaelDaum/spreadsheet-parsexlsx/issues/10
- [oss-security] 20240118 CVE-2024-23525: Spreadsheet::ParseXLSX for Perl is vulnerable to XXE attacks mailing-list
- [debian-lts-announce] 20240127 [SECURITY] [DLA 3723-1] libspreadsheet-parsexlsx-perl security update mailing-list
- https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html