{"id":"CVE-2026-107216","kind":"vulnerability","aliases":["CVE-2026-107216","GHSA-wp2g-vpjj-g53r","GO-2026-6688"],"related":[],"title":"Mutually-referencing array formulas recurse unboundedly, causing a fatal stack overflow in github.com/xuri/excelize","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, ANCHORARRAY recursively calls the exported CalcCellValue function, creating a fresh calculation context at each cycle and bypassing in-flight and iteration controls. ANCHORARRAY calls CalcCellValue instead of cellResolver, so each recursive hop receives a new calcContext and loses cycle state. When mutually referencing dynamic-array formulas are evaluated directly or through formula-evaluating APIs, each recursion hop resets the cycle budget and prevents completion-based caches from breaking the cycle, allowing an attacker to cause a fatal Go stack overflow and abort the process. No fixed version is available as of this review.","summary":"Excelize, a Go library for reading and writing Excel files, has mutually referencing dynamic-array formulas that recurse without limit in versions 2.8.1 through 2.11.0. An attacker who can get a crafted workbook evaluated can crash the whole Go process with a stack overflow.","severity":"high","cvss":7.5,"epss":0.00329,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/xuri/excelize/v2","fixed":["2.11.1-0.20260911060113-ea12859e43c6"],"affected":">= 2.8.1, < 2.11.1-0.20260911060113-ea12859e43c6","ecosystem":"go"}],"ecosystems":["go"],"tags":["excelize","file-upload","go","package","spreadsheet-processing"],"not_affected_if":["no-formula-evaluating-apis","no-untrusted-formula-evaluation","versions-outside-2.8.1-to-2.11.0"],"how_to_check":"Run `go list -m github.com/xuri/excelize/v2` and check whether the version is between 2.8.1 and 2.11.0.\nIn go.sum, look for github.com/xuri/excelize/v2 entries in that range.\nCheck whether the service evaluates formulas from untrusted spreadsheets (CalcCellValue, GetCellValue with calculation, or similar).","fix":"Upgrade to github.com/xuri/excelize/v2 v2.11.1-0.20260911060113-ea12859e43c6 or later, per the sources' fixed-version field.\nThe NVD/EPSS text says no fixed version exists yet, so confirm the fix before relying on it.","status":"open","published_at":"2026-10-07T18:17:19+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:56:11+00:00","updated_at":"2026-10-23T19:56:11+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T19:56:11Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to github.com/xuri/excelize/v2 v2.11.1-0.20260911060113-ea12859e43c6 or later, per the sources' fixed-version field.\nThe NVD/EPSS text says no fixed version exists yet, so confirm the fix before relying on it.","summary":"Excelize, a Go library for reading and writing Excel files, has mutually referencing dynamic-array formulas that recurse without limit in versions 2.8.1 through 2.11.0. An attacker who can get a crafted workbook evaluated can crash the whole Go process with a stack overflow.","category":"package","who_cares":["go","excelize","spreadsheet-processing","file-upload"],"confidence":0.7,"analyst_note":"Sources conflict: the products field lists a fixed pseudo-version, but the description says no fixed version is available. Check https://pkg.go.dev/vuln/GO-2026-6688 for the current fix status.","how_to_check":"Run `go list -m github.com/xuri/excelize/v2` and check whether the version is between 2.8.1 and 2.11.0.\nIn go.sum, look for github.com/xuri/excelize/v2 entries in that range.\nCheck whether the service evaluates formulas from untrusted spreadsheets (CalcCellValue, GetCellValue with calculation, or similar).","needs_analyst":true,"not_affected_if":["versions-outside-2.8.1-to-2.11.0","no-untrusted-formula-evaluation","no-formula-evaluating-apis"],"severity_if_unknown":"high"},"cost_usd":0.000665,"input_tokens":2360,"output_tokens":858,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107216':19A,30A '-2026':18A,26A,29A '-6688':27A '/xuri/excelize':16A '/xuri/excelize/v2':33A '2.11.0':68B,104C '2.8.1':66B,102C 'abort':190C 'allow':179C 'anchorarray':105C,128C 'api':161C 'array':4A,58B,151C 'attack':70B,181C 'avail':197C 'base':173C 'break':176C 'budget':168C 'bypass':121C 'cach':174C 'calccellvalu':110C,130C 'calccontext':141C 'calcul':115C 'call':107C,129C 'caus':8A,183C 'cellresolv':133C 'complet':172C 'completion-bas':171C 'context':116C 'control':127C 'craft':75B 'crash':79B 'creat':112C 'cve':17A,28A 'cycl':119C,144C,167C,178C 'direct':155C 'dynam':57B,150C 'dynamic-array':56B,149C 'evalu':77B,154C,160C 'excel':34B,43B,51B,88C,99C 'export':109C 'fatal':10A,185C 'file':36B,52B 'file-upload':35B 'fix':194C 'flight':124C 'formula':5A,59B,152C,159C 'formula-evalu':158C 'fresh':114C 'function':111C 'g53r':24A 'get':73B 'ghsa':21A 'ghsa-wp2g-vpjj-g53r':20A 'github.com':15A,32A 'github.com/xuri/excelize':14A 'github.com/xuri/excelize/v2':31A 'go':25A,38B,45B,82B,91C,186C 'hop':137C,164C 'in-flight':122C 'instead':131C 'iter':126C 'languag':92C 'librari':46B,93C 'limit':63B 'lose':143C 'microsoft':98C 'mutual':2A,54B,147C 'mutually-referenc':1A 'new':140C 'overflow':12A,87B,188C 'packag':39B 'prevent':170C 'process':42B,83B,192C 'read':48B,95C 'receiv':138C 'recurs':6A,61B,106C,136C,163C 'referenc':3A,55B,148C 'reset':165C 'review':201C 'spreadsheet':41B,100C 'spreadsheet-process':40B 'stack':11A,86B,187C 'state':145C 'unbound':7A 'upload':37B 'version':65B,195C 'vpjj':23A 'whole':81B 'without':62B 'workbook':76B 'wp2g':22A 'write':50B,97C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-07T18:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6688","url":"https://pkg.go.dev/vuln/GO-2026-6688","severity":null,"published_at":"2026-10-19T21:08:21+00:00","modified_at":"2026-10-19T21:08:21+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107216","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107216","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-107216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107216","severity":null,"published_at":"2026-10-07T18:17:19+00:00","modified_at":"2026-10-13T14:23:43+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}