Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution…
Priority HIGH 82CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IF(A1=200, eval("__import__('os').system( substring.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00983 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | pycel (PyPI) | up to 1.0b30 | — | No fix listed | GHSA-pw67-xjhq-389w |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- pycel (PyPI) Vendor— Affected up to 1.0b30 Fixed in — No fix listed GHSA-pw67-xjhq-389w
CPE configurations NVD · 25
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dgorissen:pycel:1.0:beta0:*:*:*:python:*:* | 1.0 beta0 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta11:*:*:*:python:*:* | 1.0 beta11 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta12:*:*:*:python:*:* | 1.0 beta12 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta13:*:*:*:python:*:* | 1.0 beta13 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta14:*:*:*:python:*:* | 1.0 beta14 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta15:*:*:*:python:*:* | 1.0 beta15 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta16:*:*:*:python:*:* | 1.0 beta16 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta17:*:*:*:python:*:* | 1.0 beta17 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta18:*:*:*:python:*:* | 1.0 beta18 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta19:*:*:*:python:*:* | 1.0 beta19 | Vulnerable | Dgorissen |
- cpe:2.3:a:dgorissen:pycel:1.0:beta0:*:*:*:python:*:* Versions 1.0 beta0 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta11:*:*:*:python:*:* Versions 1.0 beta11 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta12:*:*:*:python:*:* Versions 1.0 beta12 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta13:*:*:*:python:*:* Versions 1.0 beta13 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta14:*:*:*:python:*:* Versions 1.0 beta14 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta15:*:*:*:python:*:* Versions 1.0 beta15 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta16:*:*:*:python:*:* Versions 1.0 beta16 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta17:*:*:*:python:*:* Versions 1.0 beta17 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta18:*:*:*:python:*:* Versions 1.0 beta18 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta19:*:*:*:python:*:* Versions 1.0 beta19 Vulnerable ·Dgorissen
Show 15 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dgorissen:pycel:1.0:beta2:*:*:*:python:*:* | 1.0 beta2 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta20:*:*:*:python:*:* | 1.0 beta20 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta21:*:*:*:python:*:* | 1.0 beta21 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta22:*:*:*:python:*:* | 1.0 beta22 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta26:*:*:*:python:*:* | 1.0 beta26 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta27:*:*:*:python:*:* | 1.0 beta27 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta28:*:*:*:python:*:* | 1.0 beta28 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta29:*:*:*:python:*:* | 1.0 beta29 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta3:*:*:*:python:*:* | 1.0 beta3 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta30:*:*:*:python:*:* | 1.0 beta30 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta4:*:*:*:python:*:* | 1.0 beta4 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta5:*:*:*:python:*:* | 1.0 beta5 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta6:*:*:*:python:*:* | 1.0 beta6 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta7:*:*:*:python:*:* | 1.0 beta7 | Vulnerable | Dgorissen |
| cpe:2.3:a:dgorissen:pycel:1.0:beta8:*:*:*:python:*:* | 1.0 beta8 | Vulnerable | Dgorissen |
- cpe:2.3:a:dgorissen:pycel:1.0:beta2:*:*:*:python:*:* Versions 1.0 beta2 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta20:*:*:*:python:*:* Versions 1.0 beta20 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta21:*:*:*:python:*:* Versions 1.0 beta21 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta22:*:*:*:python:*:* Versions 1.0 beta22 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta26:*:*:*:python:*:* Versions 1.0 beta26 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta27:*:*:*:python:*:* Versions 1.0 beta27 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta28:*:*:*:python:*:* Versions 1.0 beta28 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta29:*:*:*:python:*:* Versions 1.0 beta29 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta3:*:*:*:python:*:* Versions 1.0 beta3 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta30:*:*:*:python:*:* Versions 1.0 beta30 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta4:*:*:*:python:*:* Versions 1.0 beta4 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta5:*:*:*:python:*:* Versions 1.0 beta5 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta6:*:*:*:python:*:* Versions 1.0 beta6 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta7:*:*:*:python:*:* Versions 1.0 beta7 Vulnerable ·Dgorissen
- cpe:2.3:a:dgorissen:pycel:1.0:beta8:*:*:*:python:*:* Versions 1.0 beta8 Vulnerable ·Dgorissen
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-53924
- 2026-10-03 Alias added: GHSA-pw67-xjhq-389w
References
Sources
- CVE-2024-53924 · CVE Program
- CVE-2024-53924 · NVD
- FIRST EPSS
- GHSA-pw67-xjhq-389w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences