None of them really execute "code". Pandoc has a pretty good write up of the security implications or running it, which I think applies just as much to the other ones, with the added caveat of zip bombs.
https://pandoc.org/MANUAL.html#a-note-on-security
It's just text, this isn't ripgrepping through your excel macros, just the data that's actually in the excel file.