Live › vulnerability › CVE-2026-107211
Go to dashboardExcelize, a Go library for reading and writing Excel files, panics on a crafted workbook with a pivot-table field count mismatch or an out-of-range dataField index when GetPivotTables is called. An attacker who can supply a spreadsheet can crash the process or the request worker that parses it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/xuri/excelize/v2 | go | >= 2.8.1, < 2.11.1-0.20261003002531-6258dcebc4e2 | 2.11.1-0.20261003002531-6258dcebc4e2 |
Run go list -m github.com/xuri/excelize/v2 in each service and check whether the version is between 2.8.1 and 2.11.0 inclusive.
2.11.1-0.20261003002531-6258dcebc4e2 as listed by govuln; the description says no fixed version exists yet, so confirm before relying on itEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, separately parsed pivot-table field indices are used to index the pivot-cache field-name slice without bounds checks. extractPivotTableFields uses getPivotCacheFieldsName output while processing GetPivotTables and trusts the dataField fld attribute as an index. When a crafted workbook supplies a pivot-field count mismatch or an out-of-range dataField fld value before GetPivotTables is called, the unchecked index causes a Go slice-bounds panic that escapes the library, allowing an attacker to crash the process or request worker. No fixed version is available as of this review.
This page as .md · .json · in your agent: get_signal("CVE-2026-107211")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.