Go Language Library Vulnerability in Microsoft Excel Spreadsheet Processing

CVE-2026-107222

What is CVE-2026-107222?

The Excelize Go library versions 2.7.0 to 2.11.0 contain a vulnerability that affects conditional-format extraction. The library does not properly validate the structure of rules when extracting formats from a worksheet. An attacker can leverage this flaw by supplying a crafted worksheet with incomplete or malformed rules, leading to nil dereferences or attempts to access out-of-range indices. This results in a shocked application state, potentially causing termination of unprotected processes. Currently, there is no patch available to rectify this vulnerability.

References