GHSA-PW67-XJHQ-389W Pycel allows code injection via a crafted formula

Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IFA1=200, eval"import'os'.system substring...

Pycel allows code injection via a crafted formula

Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IFA1=200, eval"import'os'.system substring...

CVE-2024-53924

Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IFA1=200, eval"import'os'.system substring...

PYSEC-2025-177

Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IFA1=200, eval"import'os'.system substring...

CVE-2024-53924

The Pycel library (versions through 1.0b30 ) is vulnerable to arbitrary code execution when processing untrusted spreadsheets. The root cause is a bypass in the symbolic safe evaluation of Excel formulas, where specially crafted formulas—such as those using =IF(A1=200, eval("__import__('os').syst...