Hi,

The following vulnerability was published for libspreadsheet-xlsx-perl.

CVE-2026-115943[0]:
| Spreadsheet::XLSX versions before 0.19 for Perl allow code execution
| via string eval of number format conditions in ExcelFmt.  When a
| number format has a condition such as [>100], ExcelFmt chooses the
| format section by passing the condition and the cell value to a
| string eval. Both come from the workbook, and the eval runs while
| Spreadsheet::XLSX->new parses it.  An attacker who supplies an XLSX
| file can run arbitrary Perl code.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-115943
https://www.cve.org/CVERecord?id=CVE-2026-115943
[1] https://lists.security.metacpan.org/cve-announce/msg/44746764/

Regards,
Salvatore