{"id":"CVE-2026-107211","kind":"vulnerability","aliases":["CVE-2026-107211","GHSA-mx22-3794-2vpv","GO-2026-6695"],"related":[],"title":"Panic via unchecked pivot-cache field index in github.com/xuri/excelize/v2","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, separately parsed pivot-table field indices are used to index the pivot-cache field-name slice without bounds checks. extractPivotTableFields uses getPivotCacheFieldsName output while processing GetPivotTables and trusts the dataField fld attribute as an index. When a crafted workbook supplies a pivot-field count mismatch or an out-of-range dataField fld value before GetPivotTables is called, the unchecked index causes a Go slice-bounds panic that escapes the library, allowing an attacker to crash the process or request worker. No fixed version is available as of this review.","summary":"Excelize, a Go library for reading and writing Excel files, panics on a crafted workbook with a pivot-table field count mismatch or an out-of-range dataField index when GetPivotTables is called. An attacker who can supply a spreadsheet can crash the process or the request worker that parses it.","severity":"high","cvss":8.7,"epss":0.00217,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/xuri/excelize/v2","fixed":["2.11.1-0.20261003002531-6258dcebc4e2"],"affected":">= 2.8.1, < 2.11.1-0.20261003002531-6258dcebc4e2","ecosystem":"go"}],"ecosystems":["go"],"tags":["excelize","file-upload-services","go","package","self-hosted"],"not_affected_if":["no-untrusted-xlsx-parsing","pivot-tables-not-read","version-outside-2.8.1-to-2.11.0"],"how_to_check":"Run `go list -m github.com/xuri/excelize/v2` in each service and check whether the version is between 2.8.1 and 2.11.0 inclusive.","fix":"Move to 2.11.1-0.20261003002531-6258dcebc4e2 as listed by govuln; the description says no fixed version exists yet, so confirm before relying on it. Until then, reject or sandbox untrusted workbooks before calling GetPivotTables.","status":"open","published_at":"2026-10-07T18:17:18+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:52:39+00:00","updated_at":"2026-10-23T19:52:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T19:52:39Z","model":"claude-haiku-5-5","output":{"fix":"Move to 2.11.1-0.20261003002531-6258dcebc4e2 as listed by govuln; the description says no fixed version exists yet, so confirm before relying on it. Until then, reject or sandbox untrusted workbooks before calling GetPivotTables.","summary":"Excelize, a Go library for reading and writing Excel files, panics on a crafted workbook with a pivot-table field count mismatch or an out-of-range dataField index when GetPivotTables is called. An attacker who can supply a spreadsheet can crash the process or the request worker that parses it.","category":"package","who_cares":["go","excelize","file-upload-services","self-hosted"],"confidence":0.6,"analyst_note":"Sources conflict: govuln lists a fixed pseudo-version but the description says no fix is available; check https://pkg.go.dev/vuln/GO-2026-6695 and the upstream excelize repo for a released fix.","how_to_check":"Run `go list -m github.com/xuri/excelize/v2` in each service and check whether the version is between 2.8.1 and 2.11.0 inclusive.","needs_analyst":true,"not_affected_if":["version-outside-2.8.1-to-2.11.0","no-untrusted-xlsx-parsing","pivot-tables-not-read"],"severity_if_unknown":"high"},"cost_usd":0.000626,"input_tokens":2320,"output_tokens":789,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107211':15A,27A '-2':20A '-2026':14A,23A,26A '-6695':24A '/xuri/excelize/v2':12A,30A '2.11.0':109C '2.8.1':107C '3794':19A 'allow':186C 'attack':77B,188C 'attribut':144C 'avail':200C 'bound':130C,180C 'cach':6A,124C 'call':75B,171C 'caus':175C 'check':131C 'count':62B,157C 'craft':54B,150C 'crash':84B,190C 'cve':13A,25A 'datafield':70B,142C,165C 'escap':183C 'excel':31B,41B,49B,93C,104C 'extractpivottablefield':132C 'field':7A,61B,115C,126C,156C 'field-nam':125C 'file':33B,50B 'file-upload-servic':32B 'fix':197C 'fld':143C,166C 'getpivotcachefieldsnam':134C 'getpivott':73B,138C,169C 'ghsa':17A 'ghsa-mx22':16A 'github.com':11A,29A 'github.com/xuri/excelize/v2':10A,28A 'go':22A,36B,43B,96C,177C 'host':40B 'index':8A,71B,120C,147C,174C 'indic':116C 'languag':97C 'librari':44B,98C,185C 'microsoft':103C 'mismatch':63B,158C 'mx22':18A 'name':127C 'out-of-rang':66B,161C 'output':135C 'packag':37B 'panic':1A,51B,181C 'pars':92B,111C 'pivot':5A,59B,113C,123C,155C 'pivot-cach':4A,122C 'pivot-field':154C 'pivot-t':58B,112C 'process':86B,137C,192C 'rang':69B,164C 'read':46B,100C 'request':89B,194C 'review':204C 'self':39B 'self-host':38B 'separ':110C 'servic':35B 'slice':128C,179C 'slice-bound':178C 'spreadsheet':82B,105C 'suppli':80B,152C 'tabl':60B,114C 'trust':140C 'uncheck':3A,173C 'upload':34B 'use':118C,133C 'valu':167C 'version':198C 'via':2A 'vpv':21A 'without':129C 'workbook':55B,151C 'worker':90B,195C 'write':48B,102C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-07T18:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6695","url":"https://pkg.go.dev/vuln/GO-2026-6695","severity":null,"published_at":"2026-10-19T21:08:21+00:00","modified_at":"2026-10-19T21:08:21+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107211","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107211","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-107211","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107211","severity":null,"published_at":"2026-10-07T18:17:18+00:00","modified_at":"2026-10-13T14:24:41+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}