Vulnerability · Published Oct 7, 2026 · Assigned by GitHub_M
CVE-2026-107211Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic
High 8.7
In plain English
A high-severity security flaw in excelize from qax-os. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, separately parsed pivot-table field indices are used to index the pivot-cache field-name slice without bounds checks. extractPivotTableFields uses getPivotCacheFieldsName output while processing GetPivotTables and trusts the dataField fld attribute as an index. When a crafted workbook supplies a pivot-field count mismatch or an out-of-range dataField fld value before GetPivotTables is called, the unchecked index causes a Go slice-bounds panic that escapes the library, allowing an attacker to crash the process or request worker. No fixed version is available as of this review.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/xuri/excelize/v2 | 2.11.1-0.20261003002531-6258dcebc4e2 | GHSA-mx22-3794-2vpv |
| Go | github.com/xuri/excelize/v2 | 2.11.1-0.20261003002531-6258dcebc4e2 | GO-2026-6695 |
Affected products (as reported)
Weakness: CWE-129 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/qax-os/excelize/security/advisories/GHSA-mx22-3794-2vpv x_refsource_CONFIRM
- https://github.com/qax-os/excelize/pull/2435 x_refsource_MISC
- https://github.com/qax-os/excelize/commit/6258dcebc4e2a2aed985c38a08098dfd908521d1 x_refsource_MISC