# github.com/xuri/excelize/v2 (Go) vulnerabilities 18 known vulnerabilities (11 high, 7 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v2.11.1 (Nov 2, 2026): no advisory affects it - Newest unaffected release: v2.11.1 (Nov 2, 2026), the latest release - Releases: 14 since v2.4.1 (Aug 1, 2021) - Registry: https://pkg.go.dev/github.com/xuri/excelize/v2 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-107225: v2.8.0 to v2.11.0 (v2.11.1 is outside it) - CVE-2026-107224: v2.4.1 to v2.11.0 (v2.11.1 is outside it) - CVE-2026-107223: v2.4.1 to v2.11.0 (v2.11.1 is outside it) - CVE-2026-107222: v2.7.0 to v2.11.0 (v2.11.1 is outside it) - CVE-2026-107221: v2.4.1 to v2.11.0 (v2.11.1 is outside it) - CVE-2026-107220: v2.7.1 to v2.11.0 (v2.11.1 is outside it) - CVE-2026-107219: v2.4.1 to v2.11.0 (v2.11.1 is outside it) - CVE-2026-107218: v2.10.1 to v2.11.0 (v2.11.1 is outside it) - CVE-2026-107217: v2.4.1 to v2.11.0 (v2.11.1 is outside it) - CVE-2026-107216: v2.8.1 to v2.11.0 (v2.11.1 is outside it) - CVE-2026-107215: v2.4.1 to v2.11.0 (v2.11.1 is outside it) - CVE-2026-107214: v2.4.1 to v2.11.0 (v2.11.1 is outside it) - CVE-2026-107213: v2.9.0 to v2.11.0 (v2.11.1 is outside it) - CVE-2026-107212: v2.4.1 to v2.11.0 (v2.11.1 is outside it) - CVE-2026-107211: v2.8.1 to v2.11.0 (v2.11.1 is outside it) - CVE-2026-54063: v2.4.1 to v2.10.1 (v2.11.0 is outside it) - CVE-2026-59162: v2.4.1 to v2.10.1 (v2.11.0 is outside it) - CVE-2026-59161: v2.4.1 to v2.10.1 (v2.11.0 is outside it) ## Advisories (18) ### [CVE-2026-107225](https://cve.now/CVE-2026-107225): Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml - Severity: Medium 6.5 - Published: Oct 7, 2026 - Affected: from 2.8.0, fixed in 2.11.1-0.20260731010303-ae2113b410e5. - Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260731010303-ae2113b410e5, which was never published). - The latest release, v2.11.1, is not affected. ### [CVE-2026-107224](https://cve.now/CVE-2026-107224): Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader - Severity: Medium 6.5 - Published: Oct 7, 2026 - Affected: from 2.1.0, fixed in 2.11.1-0.20260805032953-db93f8d89de7. - Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260805032953-db93f8d89de7, which was never published). - The latest release, v2.11.1, is not affected. ### [CVE-2026-107223](https://cve.now/CVE-2026-107223): Excelize: Unbounded \ attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process - Severity: High 7.1 - Published: Oct 7, 2026 - Affected: from 2.1.0, fixed in 2.11.1-0.20260807015645-a54c578af309. - Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260807015645-a54c578af309, which was never published). - The latest release, v2.11.1, is not affected. ### [CVE-2026-107222](https://cve.now/CVE-2026-107222): Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check - Severity: Medium 6.5 - Published: Oct 7, 2026 - Affected: from 2.7.0, fixed in 2.11.1-0.20260812075026-be7a16390fa6. - Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260812075026-be7a16390fa6, which was never published). - The latest release, v2.11.1, is not affected. ### [CVE-2026-107221](https://cve.now/CVE-2026-107221): Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API - Severity: Medium 6.5 - Published: Oct 7, 2026 - Affected: from 2.0.0, fixed in 2.11.1-0.20260816084418-46a5eb289448. - Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260816084418-46a5eb289448, which was never published). - The latest release, v2.11.1, is not affected. ### [CVE-2026-107220](https://cve.now/CVE-2026-107220): Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref - Severity: Medium 6.5 - Published: Oct 7, 2026 - Affected: from 2.7.1, fixed in 2.11.1-0.20260820023833-99903a3240e5. - Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260820023833-99903a3240e5, which was never published). - The latest release, v2.11.1, is not affected. ### [CVE-2026-107219](https://cve.now/CVE-2026-107219): Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile - Severity: High 7.5 - Published: Oct 7, 2026 - Affected: from 2.3.1, fixed in 2.11.1-0.20260906004932-2badfcd5841d. - Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260906004932-2badfcd5841d, which was never published). - The latest release, v2.11.1, is not affected. ### [CVE-2026-107218](https://cve.now/CVE-2026-107218): Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics - Severity: Medium 5.3 - Published: Oct 7, 2026 - Affected: from 2.10.1, fixed in 2.11.1-0.20260908032718-ecd99d761fe0. - Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260908032718-ecd99d761fe0, which was never published). - The latest release, v2.11.1, is not affected. ### [CVE-2026-107217](https://cve.now/CVE-2026-107217): Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows - Severity: High 7.5 - Published: Oct 7, 2026 - Affected: from 2.0.0, fixed in 2.11.1-0.20260910071107-696050fbf14e. - Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260910071107-696050fbf14e, which was never published). - The latest release, v2.11.1, is not affected. ### [CVE-2026-107216](https://cve.now/CVE-2026-107216): Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow - Severity: High 7.5 - Published: Oct 7, 2026 - Affected: from 2.8.1, fixed in 2.11.1-0.20260911060113-ea12859e43c6. - Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260911060113-ea12859e43c6, which was never published). - The latest release, v2.11.1, is not affected. ### [CVE-2026-107215](https://cve.now/CVE-2026-107215): Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS - Severity: High 7.5 - Published: Oct 7, 2026 - Affected: from 2.3.1, fixed in 2.11.1-0.20260912113515-5f636f9dcde5; fixed in 2.11.1-0.20260912113515-5f636f9dcde5. - Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260912113515-5f636f9dcde5, which was never published). - The latest release, v2.11.1, is not affected. ### [CVE-2026-107214](https://cve.now/CVE-2026-107214): Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks - Severity: High 7.5 - Published: Oct 7, 2026 - Affected: from 2.3.1, fixed in 2.11.1-0.20260915055537-22f76f9acb94; fixed in 2.11.1-0.20260915055537-22f76f9acb94. - Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260915055537-22f76f9acb94, which was never published). - The latest release, v2.11.1, is not affected. ### [CVE-2026-107213](https://cve.now/CVE-2026-107213): Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element - Severity: High 8.7 - Published: Oct 7, 2026 - Affected: from 2.9.0, fixed in 2.11.1-0.20260929015830-8ffeb07ec9a3. - Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260929015830-8ffeb07ec9a3, which was never published). - The latest release, v2.11.1, is not affected. ### [CVE-2026-107212](https://cve.now/CVE-2026-107212): Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days - Severity: High 7.5 - Published: Oct 7, 2026 - Affected: from 2.1.0, fixed in 2.11.1-0.20260930021559-01a9ff32fb3c; fixed in 2.11.1-0.20260930021559-01a9ff32fb3c. - Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20260930021559-01a9ff32fb3c, which was never published). - The latest release, v2.11.1, is not affected. ### [CVE-2026-107211](https://cve.now/CVE-2026-107211): Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic - Severity: High 8.7 - Published: Oct 7, 2026 - Affected: from 2.8.1, fixed in 2.11.1-0.20261003002531-6258dcebc4e2. - Fixed in v2.11.1 (released Nov 2, 2026, 26 days after disclosure, the advisory names 2.11.1-0.20261003002531-6258dcebc4e2, which was never published). - The latest release, v2.11.1, is not affected. ### [CVE-2026-54063](https://cve.now/CVE-2026-54063): Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS) - Severity: High 7.5 - Published: Jul 10, 2026 - Affected: fixed in 2.11.0. - Fixed in v2.11.0 (released Jul 6, 2026, 4 days before disclosure). - The latest release, v2.11.1, is not affected. ### [CVE-2026-59162](https://cve.now/CVE-2026-59162): Excelize: Negative shared-string index causes panic in GetCellValue and GetRows - Severity: Medium 6.9 - Published: Jul 10, 2026 - Affected: fixed in 2.11.0. - Fixed in v2.11.0 (released Jul 6, 2026, 4 days before disclosure). - The latest release, v2.11.1, is not affected. ### [CVE-2026-59161](https://cve.now/CVE-2026-59161): Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation - Severity: High 8.7 - Published: Jul 10, 2026 - Affected: fixed in 2.11.0. - Fixed in v2.11.0 (released Jul 6, 2026, 4 days before disclosure). - The latest release, v2.11.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/xuri/excelize/v2 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.