Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/xuri/excelize/v2

18 known vulnerabilities (11 high, 7 medium), with the versions each affects and the releases that fix them.

Latest release
v2.11.1 (Nov 2, 2026): no advisory affects it
Newest unaffected release
v2.11.1 (Nov 2, 2026), the latest release
Advisories
18 · 11 high, 7 medium
Releases
14 since v2.4.1 (Aug 1, 2021)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 18 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 18

  • CVE-2026-107225Medium 6.5

    Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml

    Affected: from 2.8.0, fixed in 2.11.1-0.20260731010303-ae2113b410e5.

    Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260731010303-ae2113b410e5, which was never published).

    The latest release, v2.11.1, is not affected.

  • CVE-2026-107224Medium 6.5

    Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader

    Affected: from 2.1.0, fixed in 2.11.1-0.20260805032953-db93f8d89de7.

    Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260805032953-db93f8d89de7, which was never published).

    The latest release, v2.11.1, is not affected.

  • Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process

    Affected: from 2.1.0, fixed in 2.11.1-0.20260807015645-a54c578af309.

    Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260807015645-a54c578af309, which was never published).

    The latest release, v2.11.1, is not affected.

  • CVE-2026-107222Medium 6.5

    Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check

    Affected: from 2.7.0, fixed in 2.11.1-0.20260812075026-be7a16390fa6.

    Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260812075026-be7a16390fa6, which was never published).

    The latest release, v2.11.1, is not affected.

  • CVE-2026-107221Medium 6.5

    Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API

    Affected: from 2.0.0, fixed in 2.11.1-0.20260816084418-46a5eb289448.

    Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260816084418-46a5eb289448, which was never published).

    The latest release, v2.11.1, is not affected.

  • CVE-2026-107220Medium 6.5

    Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref

    Affected: from 2.7.1, fixed in 2.11.1-0.20260820023833-99903a3240e5.

    Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260820023833-99903a3240e5, which was never published).

    The latest release, v2.11.1, is not affected.

  • Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile

    Affected: from 2.3.1, fixed in 2.11.1-0.20260906004932-2badfcd5841d.

    Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260906004932-2badfcd5841d, which was never published).

    The latest release, v2.11.1, is not affected.

  • CVE-2026-107218Medium 5.3

    Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics

    Affected: from 2.10.1, fixed in 2.11.1-0.20260908032718-ecd99d761fe0.

    Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260908032718-ecd99d761fe0, which was never published).

    The latest release, v2.11.1, is not affected.

  • Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows

    Affected: from 2.0.0, fixed in 2.11.1-0.20260910071107-696050fbf14e.

    Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260910071107-696050fbf14e, which was never published).

    The latest release, v2.11.1, is not affected.

  • Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow

    Affected: from 2.8.1, fixed in 2.11.1-0.20260911060113-ea12859e43c6.

    Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260911060113-ea12859e43c6, which was never published).

    The latest release, v2.11.1, is not affected.

  • Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS

    Affected: from 2.3.1, fixed in 2.11.1-0.20260912113515-5f636f9dcde5; fixed in 2.11.1-0.20260912113515-5f636f9dcde5.

    Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260912113515-5f636f9dcde5, which was never published).

    The latest release, v2.11.1, is not affected.

  • Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks

    Affected: from 2.3.1, fixed in 2.11.1-0.20260915055537-22f76f9acb94; fixed in 2.11.1-0.20260915055537-22f76f9acb94.

    Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260915055537-22f76f9acb94, which was never published).

    The latest release, v2.11.1, is not affected.

  • Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element

    Affected: from 2.9.0, fixed in 2.11.1-0.20260929015830-8ffeb07ec9a3.

    Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260929015830-8ffeb07ec9a3, which was never published).

    The latest release, v2.11.1, is not affected.

  • Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days

    Affected: from 2.1.0, fixed in 2.11.1-0.20260930021559-01a9ff32fb3c; fixed in 2.11.1-0.20260930021559-01a9ff32fb3c.

    Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260930021559-01a9ff32fb3c, which was never published).

    The latest release, v2.11.1, is not affected.

  • Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic

    Affected: from 2.8.1, fixed in 2.11.1-0.20261003002531-6258dcebc4e2.

    Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20261003002531-6258dcebc4e2, which was never published).

    The latest release, v2.11.1, is not affected.

Show all 18 advisoriesShow fewer advisories

  • Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)

    Affected: fixed in 2.11.0.

    Fixed in v2.11.0 (released Jul 6, 2026, 4 days before disclosure).

    The latest release, v2.11.1, is not affected.

  • CVE-2026-59162Medium 6.9

    Excelize: Negative shared-string index causes panic in GetCellValue and GetRows

    Affected: fixed in 2.11.0.

    Fixed in v2.11.0 (released Jul 6, 2026, 4 days before disclosure).

    The latest release, v2.11.1, is not affected.

  • Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation

    Affected: fixed in 2.11.0.

    Fixed in v2.11.0 (released Jul 6, 2026, 4 days before disclosure).

    The latest release, v2.11.1, is not affected.