CVE-2026-107220 · GHSA-g27h-8qhm-6pff
Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref
- Risk score
- 52/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser, which passes an empt…
- Affected
- github.com/xuri/excelize/v2 (go) >= 2.7.1, < 2.11.1-0.20260820023833-99903a3240e5
- Fix
- Upgrade github.com/xuri/excelize/v2 to 2.11.1-0.20260820023833-99903a3240e5 or later.
- Exploitation
- Public proof of concept
Story map
At a glance
github.com/xuri/excelize/v2: Amber, patch this week. Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the worksheet column limit. SetColWidth reaches flatCols, which expands xlsxCol.Min through xlsxCol.Max without enforcing MaxCo…
The flaws
- CVE-2026-107220: Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref (CVSS 6.5 · EPSS 0%)
- CVE-2026-107223: Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process (CVSS 7.5 · EPSS 0%)
- CVE-2026-107212: Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days (CVSS 7.5 · EPSS 0%)
- CVE-2026-107217: Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows (CVSS 7.5 · EPSS 0%)
The fix
Fix: Upgrade github.com/xuri/excelize/v2 to 2.11.1-0.20260807015645-a54c578af309 or later.
Who is exposed: github.com/xuri/excelize/v2 (go) >= 2.1.0, < 2.11.1-0.20260807015645-a54c578af309
Where it stands
- Public proof of concept
Connects to
- Same weakness: Out-of-bounds read (CWE-125). 372 other warnings in 30 days
- Same product: Earlier github.com/xuri/excelize/v2 warnings. 11 in the last 90 days
Why it is Yellow
- CVSS 6.5 medium
- Public exploit or proof of concept referenced
- On your watchlist: Go
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| github.com/xuri/excelize/v2 | go | >= 2.7.1, < 2.11.1-0.20260820023833-99903a3240e5 | 2.11.1-0.20260820023833-99903a3240e5 |
References
Original description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser, which passes an empty rectangle derived from the mergeCell ref attribute into cellInRange. When a crafted worksheet contains an empty mergeCell ref and a non-streaming cell API reads the worksheet, cellInRange indexes four positions in an empty slice, allowing an attacker to panic on the first affected cell operation. No fixed version is available as of this review.
Last activity 7 Oct 2026. Patch Forecast updates every hour.