Executive brief
Pycel is a Python library used to convert Excel spreadsheets into Python code and evaluate formulas. A security flaw allows a specially crafted spreadsheet to execute unauthorized commands on the computer running the library. If an application uses Pycel to process files from outside sources, an attacker could take full control of the underlying server or steal sensitive data.
Technical details
A code injection vulnerability (CWE-94) exists in Pycel through version 1.0b30. While the library intends to provide safe symbolic evaluation of Excel formulas, it fails to properly sanitize or block the Python-native 'eval' function when it is embedded within certain Excel logic, such as IF statements. An attacker can provide a malicious spreadsheet containing a formula like '=IF(A1=200, eval(...))' which, when processed by Pycel, executes arbitrary Python code in the context of the application. This bypasses the library's intended function-blocking mechanisms. As of the advisory date, no patched version is available.
Affected products
- dgorissen pycel <= 1.0b30
Timeline
- 2024-11-23: disclosed: Initial disclosure by researcher
- 2025-04-17: advisory: GitHub Advisory and NVD publication