Description (CNA)
Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IF(A1=200, eval("__import__('os').system( substring.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://pypi.org/project/pycel/
- https://github.com/stephenrauch/pycel
- https://github.com/dgorissen/pycel
- https://gist.github.com/aelmosalamy/cb098e61939718d2bb248fd1cc94f287
ADP enrichment
No English description supplied.