[Spirochete]

I’ve been a big Excel user for at least 30 years. I don’t think that I ever used SYLK files.

SYLK started as a export file format from Multiplan, the text precursor to Excel. It's more than 30 years old; more like 38 years.

I don't understand how the exploit works. SYLK content is just raw text and doesn't contain macros.

[Spirochete]

I don't understand how the exploit works. SYLK content is just raw text and doesn't contain macros.

I see now. It supports commands for executing code, like EXEC() and HALT().

https://outflank.nl/blog/2019/10/30/abusing-the-sylk-file-format/

Wikipedia