xuri vulnerabilities

Products

• github.com/xuri/excelize/v2 18

Latest xuri CVEs

Newest publication first

1. CVE-2026-107225 Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml

   Published 2026-10-07

   Medium·CVSS 6.5 EPSS 0.27%

   Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. File.GetStyle relies on extractStyleCondFuncs...

2. CVE-2026-107224 Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader

   Published 2026-10-07

   Medium·CVSS 6.5 EPSS 0.31%

   Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains Uncompr...

3. CVE-2026-107223 Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process

   Published 2026-10-07

   High·CVSS 7.1 EPSS 0.37%

   Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the worksheet column limit. SetColWidth reaches flatCols, which expands xlsxCol.Min thro...

4. CVE-2026-107222 Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check

   Published 2026-10-07

   Medium·CVSS 6.5 EPSS 0.27%

   Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormat...

5. CVE-2026-107221 Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API

   Published 2026-10-07

   Medium·CVSS 6.5 EPSS 0.27%

   Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice from the last cell in XML document order and then re-scatters every cell by its explicit column reference. GetCellValue reaches workS...

6. CVE-2026-107220 Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref

   Published 2026-10-07

   Medium·CVSS 6.5 EPSS 0.26%

   Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches...

7. CVE-2026-107219 Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile

   Published 2026-10-07

   High·CVSS 7.5 EPSS 0.36%

   Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecr...

8. CVE-2026-107218 Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics

   Published 2026-10-07

   Medium·CVSS 5.3 EPSS 0.31%

   Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. RIGHT reaches leftRight through CalcCellValue,...

9. CVE-2026-107217 Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows

   Published 2026-10-07

   High·CVSS 7.5 EPSS 0.36%

   Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, ColumnNameToNumber accumulates a bijective base-26 value in int64 without detecting ove...

10. CVE-2026-107216 Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow

    Published 2026-10-07

    High·CVSS 7.5 EPSS 0.38%

    Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, ANCHORARRAY recursively calls the exported CalcCellValue function, creating a fresh calculation context at each cycle and bypassing in-flight and iteration controls. ANCH...

11. CVE-2026-107215 Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS

    Published 2026-10-07

    High·CVSS 7.5 EPSS 0.24%

    Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the...

12. CVE-2026-107214 Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks

    Published 2026-10-07

    High·CVSS 7.5 EPSS 0.24%

    Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors slice, index, allocate, and divide using attacker-c...

13. CVE-2026-107213 Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element

    Published 2026-10-07

    High·CVSS 8.7 EPSS 0.23%

    Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.9.0 to 2.11.0, GetSlicers checks for ExtLst but dereferences ws.Drawing without checking whether the independently optional drawing element exists. File.GetSlicers reads ws.Drawing.RID...

14. CVE-2026-107212 Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days

    Published 2026-10-07

    High·CVSS 7.5 EPSS 0.36%

    Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows...

15. CVE-2026-107211 Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic

    Published 2026-10-07

    High·CVSS 8.7 EPSS 0.23%

    Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, separately parsed pivot-table field indices are used to index the pivot-cache field-name slice without bounds checks. extractPivotTableFields uses getPivotCacheFieldsName...

16. CVE-2026-54063 Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)

    Published 2026-07-10

    High·CVSS 7.5 EPSS 0.61%

    Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet() function in github.com/xuri/excelize/v2 uses an attacker-controlled <row r="N"> XML attribute value directly as the length argument to make([]xlsxRow, row) wi...

17. CVE-2026-59162 Excelize: Negative shared-string index causes panic in GetCellValue and GetRows

    Published 2026-07-10

    Medium·CVSS 6.9 EPSS 0.66%

    Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-...

18. CVE-2026-59161 Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation

    Published 2026-07-10

    High·CVSS 8.7 EPSS 0.66%

    Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a small XLSX file with a row number above 1048576...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.