GoPackage

github.com/360EntSecGroup-Skylar/excelize/v2

3 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-107215High 7.5
Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS
Affected: from 2.3.1.
No fix released. The latest release, v2.4.0, is still affected.
CVE-2026-107214High 7.5
Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks
Affected: from 2.3.1.
No fix released. The latest release, v2.4.0, is still affected.
CVE-2026-107212High 7.5
Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days
Affected: from 2.1.0.
No fix released. The latest release, v2.4.0, is still affected.