| Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the processCVE-2026-107223 · GHSA-FQ3V-74GV-27GMVersion ranges need review. |
github.com/360EntSecGroup-Skylar/excelize/v2github.com/xuri/excelize/v2 |
Go |
High
|
Fix reported |
|
| Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rowsCVE-2026-107217 · GHSA-C85P-XXJJ-2R75Version ranges need review. |
github.com/xuri/excelize/v2github.com/xuri/excelize |
Go |
High
|
Fix reported |
|
| Excelize: RIGHT() on supplementary-plane text slices with a negative index and panicsCVE-2026-107218 · GHSA-8JJQ-8J9W-M2V6Version ranges need review. |
github.com/xuri/excelize/v2 |
Go |
Medium
|
Fix reported |
|
| Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFileCVE-2026-107219 · GHSA-JRFJ-FHJ2-JJVMVersion ranges need review. |
github.com/360EntSecGroup-Skylar/excelize/v2github.com/xuri/excelize/v2 |
Go |
High
|
Fix reported |
|
| Excelize: Panic in cellInRange on a worksheet with an empty mergeCell refCVE-2026-107220 · GHSA-G27H-8QHM-6PFFVersion ranges need review. |
github.com/xuri/excelize/v2 |
Go |
Medium
|
Fix reported |
|
| Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read APICVE-2026-107221 · GHSA-8MCQ-6WMR-JRJVVersion ranges need review. |
github.com/xuri/excelize/v2 |
Go |
Medium
|
Fix reported |
|
| Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil checkCVE-2026-107222 · GHSA-RXCJ-4PJ5-74GRVersion ranges need review. |
github.com/xuri/excelize/v2 |
Go |
Medium
|
Fix reported |
|
| Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReaderCVE-2026-107224 · GHSA-FW94-4WWP-W8PWVersion ranges need review. |
github.com/360EntSecGroup-Skylar/excelize/v2github.com/xuri/excelize/v2 |
Go |
Medium
|
Fix reported |
|
| Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xmlCVE-2026-107225 · GHSA-5H23-36RV-PM65Version ranges need review. |
github.com/xuri/excelize/v2 |
Go |
Medium
|
Fix reported |
|
| Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflowCVE-2026-107216 · GHSA-WP2G-VPJJ-G53RVersion ranges need review. |
github.com/xuri/excelize/v2 |
Go |
High
|
Fix reported |
|
| Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panicCVE-2026-107211 · GHSA-MX22-3794-2VPVVersion ranges need review. |
github.com/xuri/excelize/v2 |
Go |
High
|
Fix reported |
|
| Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoSCVE-2026-107215 · GHSA-X2Q3-8CJH-766FVersion ranges need review. |
github.com/360EntSecGroup-Skylar/excelize/v2github.com/xuri/excelize/v2 |
Go |
High
|
Fix reported |
|
| Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing elementCVE-2026-107213 · GHSA-R7X5-4969-99P7Version ranges need review. |
github.com/xuri/excelize/v2 |
Go |
High
|
Fix reported |
|
| Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooksCVE-2026-107214 · GHSA-2J4C-FFCH-9F23Version ranges need review. |
github.com/360EntSecGroup-Skylar/excelize/v2github.com/xuri/excelize/v2 |
Go |
High
|
Fix reported |
|
| Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for daysCVE-2026-107212 · GHSA-JW42-F3RR-4CC3Version ranges need review. |
github.com/360EntSecGroup-Skylar/excelize/v2github.com/xuri/excelize/v2 |
Go |
High
|
Fix reported |
|
| Excelize: Negative shared-string index causes panic in GetCellValue and GetRowsCVE-2026-59162 · GHSA-FX5J-QCQG-GRPFVersion ranges need review. |
github.com/xuri/excelize/v2github.com/xuri/excelize |
Go |
Medium
|
Fix reported |
|
| Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocationCVE-2026-59161 · GHSA-Q5J5-6P94-4GWCVersion ranges need review. |
github.com/xuri/excelize/v2github.com/xuri/excelize |
Go |
High
|
Fix reported |
|
| Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)CVE-2026-54063 · GHSA-H69G-9HX6-F3V4Version ranges need review. |
github.com/xuri/excelize/v2 |
Go |
High
|
Fix reported |
|
