CVE-2024-53924

critical · 9.8

Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IF(A1=200, eval("__import__('os').system( substring.

9.8

CVSS

1.0%

EPSS (exploit prob.)

61st

EPSS percentile

2025-04-17

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0
dgorissen	pycel	1.0

Check a specific version with /api/v1/cve/match.

References

https://gist.github.com/aelmosalamy/cb098e61939718d2bb248fd1cc94f287
https://github.com/dgorissen/pycel
https://github.com/stephenrauch/pycel
https://pypi.org/project/pycel/
https://gist.github.com/aelmosalamy/cb098e61939718d2bb248fd1cc94f287

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-53924