GITHUB.COM/XURI/EXCELIZE/V2 · CVE-2026-107221 · Package
FIX → 2.11.1-0.20260816084418-46a5eb289448
Reading an xlsx worksheet with out-of-order cell column references causes the excelize Go library to panic. An attacker who supplies a crafted spreadsheet can crash the process that parses it, a denial of service.
first public Aug 16, 2026 · 3 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Go services that open untrusted .xlsx files with excelize's worksheet reading functions are exposed, because a malformed file can trigger the panic. Programs that only write spreadsheets, or that read only files they generated themselves, can skip it. The sources do not say whether recovered panics in HTTP handlers still take down the process.
Not affected if trusted-input, writes-only
Who cares cwe-787, excelize, go, spreadsheet-parsing
github.com/xuri/excelize/v2 in go.mod and check the version listed.go list -m github.com/xuri/excelize/v2 in the module to print the resolved version.ae2113b (current HEAD).rows.go:967 ws.SheetData.Row[rowIdx].C[colNum-1] = *colData inside checkRow.checkRow computes lastCol from the column of the last cell in document order (rows.go:940), allocates targetList of that length, then re-scatters every source cell into C[colNum-1].The slice is sized from the last cell's column, but cells are not required to be column-sorted in the XML. A cell that appears earlier in the row but references a higher column than the last cell has colNum-1 >= len(targetList), so the assignment writes out of range. MaxColumns/TotalRows do not help, every individual column is valid; the bug is the ordering assumption, not magnitude.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 2.11.1-0.20260816084418-46a5eb289448
github.com/xuri/excelize/v2 2.11.1-0.20260816084418-46a5eb289448Any service that opens an untrusted spreadsheet and calls a worksheet API that goes through workSheetReader -> checkRow (excelize.go:332): GetCellValue, GetCellFormula, CalcCellValue, GetMergeCells, SetCellValue, and essentially every non-streaming worksheet call. (The streaming GetRows/Rows() SAX path does not trigger it.) Unauthenticated, deterministic, unrecovered panic -> process crash.
Crafted xl/worksheets/sheet1.xml with a row whose cells are out of column order and whose earlier cell exceeds the last cell's column:
<row r="1"><c r="D1"><v>4</v></c><c r="C1"><v>3</v></c></row>
GetCellValue("Sheet1","A1") (via getCellStringFunc -> workSheetReader -> checkRow) panicked index out of range [3] with length 3 at rows.go:967.
Confirming grep:
rg -n "func checkRow|lastCol|Row\[rowIdx\].C\[colNum-1\]" rows.go
Size targetList from the maximum cell column in the row (not the last cell in document order), or bounds-check colNum-1 against len(targetList) and grow the slice as needed before the assignment.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Go Vulnerability Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain · GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.