Go/github.com/xuri/excelize/v2 CVE-2026-107214: high 7.5, EPSS 0.24%
Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks
Action: Upgrade github.com/xuri/excelize/v2 to 2.11.1-0.20260915055537-22f76f9acb94 or later.
go get github.com/xuri/excelize/v2@v2.11.1-0.20260915055537-22f76f9acb94Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.3.1 | 2.11.1-0.20260915055537-22f76f9acb94 | - |
Fixed versions
| 2.11.1-0.20260915055537-22f76f9acb94 |
Sources
- osv: GHSA-2j4c-ffch-9f23
- https://github.com/qax-os/excelize/security/advisories/GHSA-2j4c-ffch-9f23
- https://nvd.nist.gov/vuln/detail/CVE-2026-107214
- https://github.com/qax-os/excelize/pull/2395
- https://github.com/qax-os/excelize/commit/22f76f9acb94b85b3eb9c4365ab4f750cebbc565
- https://github.com/qax-os/excelize
CVE-2026-107214 · published · modified · JSON