Go/github.com/xuri/excelize/v2 CVE-2026-107219: high 7.5, EPSS 0.34%
Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile
Action: Upgrade github.com/xuri/excelize/v2 to 2.11.1-0.20260906004932-2badfcd5841d or later.
go get github.com/xuri/excelize/v2@v2.11.1-0.20260906004932-2badfcd5841dAffected
| introduced | fixed | last affected |
|---|---|---|
| 2.3.1 | 2.11.1-0.20260906004932-2badfcd5841d | - |
Fixed versions
| 2.11.1-0.20260906004932-2badfcd5841d |
Sources
- osv: GHSA-jrfj-fhj2-jjvm
- https://github.com/qax-os/excelize/security/advisories/GHSA-jrfj-fhj2-jjvm
- https://github.com/qax-os/excelize/pull/2389
- https://github.com/qax-os/excelize/commit/2badfcd5841d0d88b0ffea119f5a2f3c53b4910b
- https://github.com/qax-os/excelize
CVE-2026-107219 · published · modified · JSON