{"affected":[{"database_specific":{"source":"https://github.com/RConsortium/r-advisory-database/blob/main/vulns/gdata/RSEC-2023-9.yaml"},"package":{"ecosystem":"CRAN","name":"gdata","purl":"pkg:cran/gdata"},"ranges":[{"events":[{"introduced":"2.16.1"},{"fixed":"3.0.0"}],"type":"ECOSYSTEM"}],"versions":["2.16.1","2.17.0","2.18.0","2.18.0.1","2.19.0"]}],"details":"Bundled Perl script Spreadsheet::ParseExcel version 0.65 is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type \"eval\". Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic. Fixed with the depreation of Excel-related functionality from gdata version 3.0.0 -- upgrading advised.","id":"RSEC-2023-9","modified":"2025-05-19T19:43:48.455096Z","published":"2025-05-16T00:12:44Z","references":[{"type":"WEB","url":"https://security-tracker.debian.org/tracker/CVE-2023-7101"},{"type":"WEB","url":"https://github.com/r-gregmisc/gdata/issues/14"}],"schema_version":"1.7.3","summary":"Arbitrary Code Execution (ACE) Vulnerability","upstream":["CVE-2023-7101"]}