Is CVE-2026-107211 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107211 being exploited in the wild.

How severe is CVE-2026-107211?

High severity, with a CVSS score of 4, published 8 October 2026.

Which products and versions are affected?

github.com/xuri/excelize/v2 (Go) >= 2.8.1, < 2.11.1-0.20261003002531-6258dcebc4e2, SEMVER:introduced=2.8.1,fixed=2.11.1-0.20261003002531-6258dcebc4e2; Xuri Excelize prior to fix.

Is there a fix for CVE-2026-107211?

Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20261003002531-6258dcebc4e2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107211 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107211?

Check whether you run github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107211: Excelize unchecked pivot-cache field index bounds in extractPivotTableFields

Q: Is there a fix for CVE-2026-107211?

Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20261003002531-6258dcebc4e2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107211 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-107211?

Check whether you run github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107211 · Severity: high · CVSS 4 · Published 2026-10-08

Excelize is a Go library for reading and writing Excel files. An attacker can craft a malicious Excel workbook with mismatched pivot table and pivot cache field definitions that causes the library to crash with an unrecovered panic when processing the file. This enables a denial-of-service attack against any service that opens untrusted Excel files and accesses their pivot tables.

Technologies: github.com/xuri/excelize/v2 (Go), Xuri Excelize. Vendors: Go, Xuri.

Quick answers

Is CVE-2026-107211 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107211 being exploited in the wild.
How severe is CVE-2026-107211?: High severity, with a CVSS score of 4, published 8 October 2026.
Which products and versions are affected?: github.com/xuri/excelize/v2 (Go) >= 2.8.1, < 2.11.1-0.20261003002531-6258dcebc4e2, SEMVER:introduced=2.8.1,fixed=2.11.1-0.20261003002531-6258dcebc4e2; Xuri Excelize prior to fix.
Is there a fix for CVE-2026-107211?: Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20261003002531-6258dcebc4e2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107211 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107211?: Check whether you run github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20261003002531-6258dcebc4e2 or later
```
go get github.com/xuri/excelize/v2@v2.11.1-0.20261003002531-6258dcebc4e2
```

Technical details

The extractPivotTableFields function in pivotTable.go indexes a pivot cache fields array (order) without validating bounds against values from separately-parsed pivot table XML: field indices are taken directly from the untrusted int attribute fld="N" in dataField elements, and fieldIdx loop counters over pt.PivotFields.PivotField are used to index order without confirming the counts match. An attacker can set fld to an out-of-range value or truncate cache field definitions to trigger index-out-of-range panics at lines 1431, 1434, 1437, or 1443. The Go runtime does not recover these panics, terminating the host process.

Affected products

xuri Excelize prior to fix

Identifiers

CVE-2026-107211
GHSA-mx22-3794-2vpv
GO-2026-6695

Timeline

2026-10-08: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.