Start for Free
go

github.com/xuri/excelize/v2

View on go registry
36 Total advisories
36 Vulnerabilities
0 Malware

Dependency scanning

Check whether github.com/xuri/excelize/v2 is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

Explore dependency scanning Explore AI SAST →

Vulnerabilities

UNKNOWN
Go

CVE-2026-107223

Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process
MEDIUM 6.5
Go

CVE-2026-107220

Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref
MEDIUM 5.3
Go

CVE-2026-107218

Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics
MEDIUM 6.5
Go

CVE-2026-107225

Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml
MEDIUM 6.5
Go

CVE-2026-107221

Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API
HIGH 7.5
Go

CVE-2026-107219

Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile
HIGH 7.5
Go

CVE-2026-107217

Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows
MEDIUM 6.5
Go

CVE-2026-107222

Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check
MEDIUM 6.5
Go

CVE-2026-107224

Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader
UNKNOWN
Go

CVE-2026-107219

Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile in github.com/xuri/excelize
UNKNOWN
Go

CVE-2026-107225

Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml in github.com/xuri/excelize
UNKNOWN
Go

CVE-2026-107221

Panic on out-of-order cell column references when reading worksheets in github.com/xuri/excelize
UNKNOWN
Go

CVE-2026-107218

Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics in github.com/xuri/excelize
UNKNOWN
Go

CVE-2026-107220

Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref in github.com/xuri/excelize
UNKNOWN
Go

CVE-2026-107222

GetConditionalFormats indexes conditional-formatting rule sub-elements with no length / nil check in github.com/xuri/excelize
UNKNOWN
Go

CVE-2026-107217

Integer overflow yields an out-of-domain coordinate with nil error, causing panic in github.com/xuri/excelize
UNKNOWN
Go

CVE-2026-107223

Unbounded <col max> lacks MaxColumns check in flatCols(), causing column mutators to hang or OOM in github.com/xuri/excelize
UNKNOWN
Go

CVE-2026-107224

Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader in github.com/xuri/excelize
HIGH 7.5
Go

CVE-2026-107216

Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow
HIGH 7.5
Go

CVE-2026-107215

Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS
UNKNOWN
Go

CVE-2026-107211

Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic
UNKNOWN
Go

CVE-2026-107213

Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element
HIGH 7.5
Go

CVE-2026-107214

Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks
HIGH 7.5
Go

CVE-2026-107212

Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days
UNKNOWN
Go

CVE-2026-107215

Panic and memory exhaustion via unbounded CFB stream allocation in github.com/xuri/excelize
UNKNOWN
Go

CVE-2026-107216

Mutually-referencing array formulas recurse unboundedly, causing a fatal stack overflow in github.com/xuri/excelize
UNKNOWN
Go

CVE-2026-107213

Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element in github.com/xuri/excelize
UNKNOWN
Go

CVE-2026-107211

Panic via unchecked pivot-cache field index in github.com/xuri/excelize/v2
UNKNOWN
Go

CVE-2026-107214

Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks in github.com/xuri/excelize
UNKNOWN
Go

CVE-2026-107212

Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days in github.com/xuri/excelize
UNKNOWN
Go

CVE-2026-59162

Panic via negative shared-string index in github.com/xuri/excelize
UNKNOWN
Go

CVE-2026-59162

Excelize: Negative shared-string index causes panic in GetCellValue and GetRows
UNKNOWN
Go

CVE-2026-59161

Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation
UNKNOWN
Go

CVE-2026-59161

Unbounded memory allocation via streaming row reader in github.com/xuri/excelize
HIGH 7.5
Go

CVE-2026-54063

Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)
UNKNOWN
Go

CVE-2026-54063

Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS) in github.com/xuri/excelize

Browse more Go advisories

Learn What is SAST?

Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes