CVE-2024-53924: Pycel allows code injection via a crafted formula

April 17, 2025 (updated June 8, 2026)

Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IF(A1=200, eval("__import__('os').system( substring.

References

gist.github.com/aelmosalamy/cb098e61939718d2bb248fd1cc94f287
github.com/advisories/GHSA-pw67-xjhq-389w
github.com/dgorissen/pycel
github.com/pypa/advisory-database/tree/main/vulns/pycel/PYSEC-2025-177.yaml
github.com/stephenrauch/pycel
nvd.nist.gov/vuln/detail/CVE-2024-53924
pypi.org/project/pycel

Code Behaviors & Features

Detect and mitigate CVE-2024-53924 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →