CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2024-53924
Critical (9.8) in dgorissen pycel. EPSS 1.0% chance of exploitation in the next 30 days.
Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IF(A1=200, eval("__import__('os').system( substring.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
- CWE
- CWE-94
- Published
- Modified
- Record from
- the NVD, synced
Affected
- dgorissen:pycel
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-pw67-xjhq-389w | PyPI | pycel | <=1.0b30 | no fix published |
| PYSEC-2025-177 | PyPI | pycel | <=1.0-beta0 <=1.0-beta11 <=1.0-beta12 <=1.0-beta13 <=1.0-beta14 <=1.0-beta15 <=1.0-beta16 <=1.0-beta17 <=1.0-beta18 <=1.0-beta19 <=1.0-beta2 <=1.0-beta20 <=1.0-beta21 <=1.0-beta22 <=1.0-beta26 <=1.0-beta27 <=1.0-beta28 <=1.0-beta29 <=1.0-beta3 <=1.0-beta30 <=1.0-beta4 <=1.0-beta5 <=1.0-beta6 <=1.0-beta7 <=1.0-beta8 | no fix published |