{"action":"Upgrade github.com/xuri/excelize/v2 to 2.11.1-0.20261003002531-6258dcebc4e2 or later.","affected":[{"fixed":"2.11.1-0.20261003002531-6258dcebc4e2","introduced":"2.8.1"}],"component":"github.com/xuri/excelize/v2","cve_ids":["CVE-2026-107211"],"ecosystem":"Go","exploited":false,"fixed_versions":["2.11.1-0.20261003002531-6258dcebc4e2"],"ghsa_id":"GHSA-mx22-3794-2vpv","id":"tcs_01M5JJPQD8X980NXMT65CZWKH8","modified_at":"2026-10-19T21:41:17.333023394Z","published_at":"2026-10-08T17:52:17Z","references":["https://osv.dev/vulnerability/GHSA-mx22-3794-2vpv","https://github.com/qax-os/excelize/security/advisories/GHSA-mx22-3794-2vpv","https://nvd.nist.gov/vuln/detail/CVE-2026-107211","https://github.com/qax-os/excelize/pull/2435","https://github.com/qax-os/excelize/commit/6258dcebc4e2a2aed985c38a08098dfd908521d1","https://github.com/qax-os/excelize"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"GHSA-mx22-3794-2vpv","url":"https://osv.dev/vulnerability/GHSA-mx22-3794-2vpv"},{"source":"nvd","source_id":"CVE-2026-107211","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107211"}],"summary":"Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic"}