{"id":"CVE-2026-107222","kind":"vulnerability","aliases":["CVE-2026-107222","GHSA-rxcj-4pj5-74gr","GO-2026-6682"],"related":[],"title":"Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check","description":"## Summary\n\n`GetConditionalFormats` reads sub-elements of a `<cfRule>` straight out of `xl/worksheets/sheetN.xml` and indexes them without checking length, and in one case without checking for nil. Three rule types are affected: `cellIs`, `dataBar` and `colorScale`. A workbook with a rule that is missing a child a real Excel file would always have panics the call.\n\n## Where it is\n\nAll three sinks are in `styles.go`, at the same line numbers in v2.11.0 and on master `d552a7e`. All three are reached from `GetConditionalFormats` through `styles.go:3271`.\n\n`styles.go:3003`, in `extractCondFmtCellIs`:\n\n```go\n\tformat.Value = c.Formula[0]\n```\n\nThe branch above it handles `len(c.Formula) == 2`; this one is the fallback and does not check that there is a formula at all, so a `cellIs` rule with no `<formula>` child indexes an empty slice.\n\n`styles.go:3132`, in the colorScale extractor:\n\n```go\n\tvalues := len(c.ColorScale.Cfvo)\n```\n\n`c.ColorScale` is a `*xlsxColorScale` and is nil when the `<cfRule type=\"colorScale\">` element has no `<colorScale>` child. Lines 3148 and 3153 then index `Cfvo[1]` and `Cfvo[2]` in the three-colour branch with no length check either.\n\n`styles.go:3186`, `:3188` and `:3190`, in the dataBar extractor:\n\n```go\n\t\tformat.MinType = c.DataBar.Cfvo[0].Type\n\t\t...\n\t\tformat.BarColor = \"#\" + f.getThemeColor(c.DataBar.Color[0])\n```\n\nThe guard here is `c.DataBar != nil`, which says nothing about the length of `Cfvo` or `Color`, so an empty `<dataBar></dataBar>` element reaches all three.\n\n## Who the attacker is\n\nAnyone who can hand a spreadsheet to a service that opens it and calls `GetConditionalFormats`. No authentication, no user interaction beyond the service doing its normal job, and the file is small.\n\n## Reproduction\n\nThree minimal `.xlsx` files were built, each a real zip with `[Content_Types].xml`, `_rels/.rels`, `xl/workbook.xml`, `xl/_rels/workbook.xml.rels` and one worksheet, opened each with the public `excelize.OpenReader` and called `GetConditionalFormats(\"Sheet1\")`. Nothing internal is touched.\n\nThe worksheet fragment for the `cellIs` case, note there is no `<formula>` child:\n\n```xml\n<conditionalFormatting sqref=\"A1\"><cfRule type=\"cellIs\" operator=\"equal\" priority=\"1\" dxfId=\"0\"/></conditionalFormatting>\n```\n\nfor `dataBar`:\n\n```xml\n<conditionalFormatting sqref=\"A1\"><cfRule type=\"dataBar\" priority=\"1\"><dataBar></dataBar></cfRule></conditionalFormatting>\n```\n\nand for `colorScale`:\n\n```xml\n<conditionalFormatting sqref=\"A1\"><cfRule type=\"colorScale\" priority=\"1\"/></conditionalFormatting>\n```\n\nObserved against master `d552a7e` on go1.26.5:\n\n```text\ncellIs      panic: runtime error: index out of range [0] with length 0\n              styles.go:3003\n              styles.go:1217\n              styles.go:3271\n\ndataBar     panic: runtime error: index out of range [0] with length 0\n              styles.go:3186\n              styles.go:1262\n              styles.go:3271\n\ncolorScale  panic: runtime error: invalid memory address or nil pointer dereference\n              styles.go:3132\n              styles.go:1259\n              styles.go:3271\n```\n\nOne honesty note on impact. These are ordinary Go panics, not fatal errors, so a caller that wraps the call in `recover` survives them.\n\n## Suggested fix\n\nLength-check `c.Formula` before line 3003 and return the rule with an empty value when there is no formula. Nil-check `c.ColorScale` before line 3132 and length-check `ColorScale.Cfvo` before indexing 1 and 2. Length-check `DataBar.Cfvo` and `DataBar.Color` alongside the existing nil check at 3186 to 3190. Skipping the malformed rule rather than erroring would keep `GetConditionalFormats` usable on files that are merely sloppy.\n\n## Affected versions\n\n`github.com/xuri/excelize/v2` up to and including v2.11.0, and master at `d552a7e`. I read the three sinks at tag v2.11.0 and at master and ran the reproducers against master.","summary":"The excelize Go library indexes conditional-formatting rule sub-elements without checking their length or nil state, so reading a malformed spreadsheet can panic. The sources do not say whether an attacker can run code or read data from this.","severity":"medium","cvss":6.5,"epss":0.0027,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/xuri/excelize/v2","fixed":["2.11.1-0.20260812075026-be7a16390fa6"],"affected":">= 2.7.0, < 2.11.1-0.20260812075026-be7a16390fa6","ecosystem":"go"},{"name":"excelize","fixed":[],"affected":">= 2.7.0, <= 2.11.0","ecosystem":"vendor"}],"ecosystems":["go","vendor"],"tags":["cwe-129","cwe-476","excelize","go","package","spreadsheet-parsing"],"not_affected_if":["no-untrusted-spreadsheets","versions-at-or-after-fix","versions-before-2.7.0"],"how_to_check":"- Check whether the project depends on `github.com/xuri/excelize/v2` with `go list -m github.com/xuri/excelize/v2`\n- Check whether the version is `2.7.0` or later and below `2.11.1-0.20260812075026-be7a16390fa6`\n- Check whether the app calls `GetConditionalFormats` on spreadsheets from untrusted users","fix":"- `github.com/xuri/excelize/v2` `2.11.1-0.20260812075026-be7a16390fa6`","status":"open","published_at":"2026-10-07T19:17:34+00:00","first_seen_at":"2026-11-06T00:09:03+00:00","triaged_at":"2026-11-06T00:10:48+00:00","updated_at":"2026-11-06T00:19:08+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-06T00:10:48Z","model":"claude-haiku-5-5","output":{"fix":"- `github.com/xuri/excelize/v2` `2.11.1-0.20260812075026-be7a16390fa6`","reach":"unknown","title":"Excelize: crafted spreadsheet can crash Go apps reading conditional formats","impact":"low","summary":"The excelize Go library indexes conditional-formatting rule sub-elements without checking their length or nil state, so reading a malformed spreadsheet can panic. The sources do not say whether an attacker can run code or read data from this.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","excelize","spreadsheet-parsing"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; a malformed file likely causes a crash","analyst_note":"","how_to_check":"- Check whether the project depends on `github.com/xuri/excelize/v2` with `go list -m github.com/xuri/excelize/v2`\n- Check whether the version is `2.7.0` or later and below `2.11.1-0.20260812075026-be7a16390fa6`\n- Check whether the app calls `GetConditionalFormats` on spreadsheets from untrusted users","plain_action":"","needs_analyst":false,"not_affected_if":["versions-before-2.7.0","versions-at-or-after-fix","no-untrusted-spreadsheets"],"who_is_affected":"Go applications that import excelize v2 from 2.7.0 up to but not including the fixed pseudo-version and call GetConditionalFormats on workbooks they did not create. Applications that only write spreadsheets or only read files they produce are unlikely to reach the flawed code path. The sources do not say whether the impact goes beyond a crash.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000744,"input_tokens":4271,"output_tokens":633,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107222':19A,30A '-129':36B '-2026':18A,26A,29A '-476':38B '-6682':27A '/xuri/excelize/v2':33A,535C '0':174C,265C,270C,400C,403C,415C,418C '1':239C,496C '2':182C,242C,498C '3003':468C '3132':488C '3148':233C '3153':235C '3186':511C '3188':255C '3190':257C,513C '4pj5':23A '74gr':24A 'address':428C 'affect':115C,531C 'alongsid':505C 'alway':135C 'anyon':298C 'attack':78B,296C 'authent':314C 'beyond':318C 'branch':176C,248C 'built':336C 'c.colorscale':219C,485C 'c.colorscale.cfvo':218C 'c.databar':275C 'c.databar.cfvo':264C 'c.databar.color':269C 'c.formula':173C,181C,465C 'call':139C,311C,358C,455C 'caller':451C 'case':106C,371C 'celli':116C,201C,370C,392C 'cfvo':238C,241C,284C 'check':16A,58B,101C,108C,191C,252C,464C,484C,492C,501C,509C 'child':129C,205C,231C,376C 'code':81B 'color':286C 'colorscal':119C,213C,383C,422C 'colorscale.cfvo':493C 'colour':247C 'condit':5A,51B 'conditional-format':4A,50B 'content':342C 'cve':17A,28A 'cwe':35B,37B 'd552a7e':159C,388C,544C 'data':84B 'databar':117C,260C,379C,407C 'databar.cfvo':502C 'databar.color':504C 'derefer':432C 'either':253C 'element':10A,56B,90C,228C,290C 'empti':208C,289C,475C 'error':395C,410C,425C,448C,520C 'excel':1A,39B,46B,132C 'excelize':34A 'excelize.openreader':356C 'exist':507C 'extractcondfmtcelli':170C 'extractor':214C,261C 'f.getthemecolor':268C 'fallback':187C 'fatal':447C 'file':133C,327C,334C,526C 'fix':461C 'format':6A,52B 'format.barcolor':267C 'format.mintype':263C 'format.value':172C 'formula':196C,481C 'fragment':367C 'getconditionalformat':2A,86C,165C,312C,359C,523C 'ghsa':21A 'ghsa-rxcj-4pj5-74gr':20A 'github.com':32A,534C 'github.com/xuri/excelize/v2':31A,533C 'go':25A,40B,47B,171C,215C,262C,444C 'go1.26.5':390C 'guard':272C 'hand':301C 'handl':179C 'honesti':437C 'impact':440C 'includ':539C 'index':3A,49B,98C,206C,237C,396C,411C,495C 'interact':317C 'intern':362C 'invalid':426C 'job':324C 'keep':522C 'len':180C,217C 'length':13A,60B,102C,251C,282C,402C,417C,463C,491C,500C 'length-check':462C,490C,499C 'librari':48B 'line':152C,232C,467C,487C 'malform':67B,516C 'master':158C,387C,542C,555C,561C 'memori':427C 'mere':529C 'minim':332C 'miss':127C 'nil':15A,62B,110C,225C,276C,430C,483C,508C 'nil-check':482C 'normal':323C 'note':372C,438C 'noth':279C,361C 'number':153C 'observ':385C 'one':105C,184C,349C,436C 'open':308C,351C 'ordinari':443C 'packag':41B 'panic':70B,137C,393C,408C,423C,445C 'pars':44B 'pointer':431C 'public':355C 'ran':557C 'rang':399C,414C 'rather':518C 'reach':163C,291C 'read':65B,83B,87C,546C 'real':131C,339C 'recov':457C 'rels/.rels':345C 'reproduc':559C 'reproduct':330C 'return':470C 'rule':7A,53B,112C,124C,202C,472C,517C 'run':80B 'runtim':394C,409C,424C 'rxcj':22A 'say':75B,278C 'servic':306C,320C 'sheet1':360C 'sink':145C,549C 'skip':514C 'slice':209C 'sloppi':530C 'small':329C 'sourc':72B 'spreadsheet':43B,68B,303C 'spreadsheet-pars':42B 'state':63B 'straight':93C 'styles.go':148C 'styles.go:1217':405C 'styles.go:1259':434C 'styles.go:1262':420C 'styles.go:3003':168C,404C 'styles.go:3132':210C,433C 'styles.go:3186':254C,419C 'styles.go:3271':167C,406C,421C,435C 'sub':9A,55B,89C 'sub-el':8A,54B,88C 'suggest':460C 'summari':85C 'surviv':458C 'tag':551C 'text':391C 'three':111C,144C,161C,246C,293C,331C,548C 'three-colour':245C 'touch':364C 'type':113C,266C,343C 'usabl':524C 'user':316C 'v2.11.0':155C,540C,552C 'valu':216C,476C 'version':532C 'whether':76B 'without':57B,100C,107C 'workbook':121C 'worksheet':350C,366C 'would':134C,521C 'wrap':453C 'xl/_rels/workbook.xml.rels':347C 'xl/workbook.xml':346C 'xl/worksheets/sheetn.xml':96C 'xlsx':333C 'xlsxcolorscal':222C 'xml':344C,377C,380C,384C 'zip':340C","nicknames":[],"mitigations":[],"who_affected":"Go applications that import excelize v2 from 2.7.0 up to but not including the fixed pseudo-version and call GetConditionalFormats on workbooks they did not create. Applications that only write spreadsheets or only read files they produce are unlikely to reach the flawed code path. The sources do not say whether the impact goes beyond a crash.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["excelize","githubcomxuriexcelizev2"],"ptokens":["com","excelize","github","v2","xuri"],"labels":["cwe129","cwe476","excelize","go","medium","package","spreadsheetparsing","vendor"],"campaign_type":null,"first_public_at":"2026-08-12T06:55:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6682","url":"https://pkg.go.dev/vuln/GO-2026-6682","severity":null,"published_at":"2026-11-05T22:53:46+00:00","modified_at":"2026-11-05T22:53:46+00:00","first_seen_at":"2026-11-06T00:09:03+00:00","fetched_at":"2026-11-06T00:09:03+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-107222","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107222","severity":null,"published_at":"2026-10-07T19:17:34+00:00","modified_at":"2026-10-13T14:18:54+00:00","first_seen_at":"2026-11-06T00:19:01+00:00","fetched_at":"2026-11-06T00:19:01+00:00","note":null},{"source":"ghsa","external_id":"GHSA-rxcj-4pj5-74gr","url":"https://github.com/advisories/GHSA-rxcj-4pj5-74gr","severity":"medium","published_at":"2026-10-07T20:22:54+00:00","modified_at":"2026-10-07T20:22:57+00:00","first_seen_at":"2026-11-06T00:19:08+00:00","fetched_at":"2026-11-06T00:19:08+00:00","note":null}],"documents":[{"id":81818,"url":"https://github.com/qax-os/excelize/commit/be7a16390fa69c71d3ca618c741d1a2b5ed362cd","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":81819,"url":"https://github.com/qax-os/excelize/pull/2375","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":81820,"url":"https://github.com/qax-os/excelize/security/advisories/GHSA-rxcj-4pj5-74gr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-12T06:55:58+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":81930,"url":"https://api.github.com/repos/qax-os/excelize/security-advisories/GHSA-rxcj-4pj5-74gr","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"}],"exploit_sources":[{"type":"epss","score":0.0027,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107222"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}