Vulnerability · Published Oct 7, 2026 · Assigned by GitHub_M
CVE-2026-107222Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check
Medium 6.5
In plain English
A medium-severity null pointer dereference in excelize from qax-os. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormats reaches extractCondFmtCellIs and also indexes ColorScale.Cfvo, DataBar.Cfvo, and DataBar.Color without complete structural checks. When a crafted worksheet supplies a cellIs, dataBar, or colorScale rule missing expected children and the application calls GetConditionalFormats, missing formula, color, value-object, or colorScale data reaches an out-of-range index or nil dereference, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/xuri/excelize/v2 | 2.11.1-0.20260812075026-be7a16390fa6 | GHSA-rxcj-4pj5-74gr |
| Go | github.com/xuri/excelize/v2 | 2.11.1-0.20260812075026-be7a16390fa6 | GO-2026-6682 |
Affected products (as reported)
Weakness: CWE-129, CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
- https://github.com/qax-os/excelize/security/advisories/GHSA-rxcj-4pj5-74gr x_refsource_CONFIRM
- https://github.com/qax-os/excelize/pull/2375 x_refsource_MISC
- https://github.com/qax-os/excelize/commit/be7a16390fa69c71d3ca618c741d1a2b5ed362cd x_refsource_MISC