GoPackage

github.com/xuri/excelize

3 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: v1.4.0 (Sep 13, 2018): affected by 3 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 3 · 2 high, 1 medium

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-107217High 7.5
Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows
Affected: from 1.1.0, through 1.4.1.
No fix released. The latest release, v1.4.0, is still affected.
CVE-2026-59162Medium 6.9
Excelize: Negative shared-string index causes panic in GetCellValue and GetRows
Affected: through 1.4.0.
No fix released. The latest release, v1.4.0, is still affected.
CVE-2026-59161High 8.7
Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation
Affected: through 1.4.0.
No fix released. The latest release, v1.4.0, is still affected.