Is CVE-2026-107222 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107222 being exploited in the wild.

How severe is CVE-2026-107222?

Medium severity, with a CVSS score of 6.5, published 7 October 2026.

Which products and versions are affected?

github.com/xuri/excelize/v2 (Go) >= 2.7.0, < 2.11.1-0.20260812075026-be7a16390fa6, SEMVER:introduced=2.7.0,fixed=2.11.1-0.20260812075026-be7a16390fa6; Xuri Excelize up to and including v2.11.0.

How is CVE-2026-107222 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107222?

Check whether you run github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107222: Excelize GetConditionalFormats index out of bounds in conditional formatting

Q: Is there a fix for CVE-2026-107222?

Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260812075026-be7a16390fa6 or later. Until then: Wrap calls to GetConditionalFormats in a recover block to handle panics gracefully, or restrict the source of Excel files processed by the application to trusted uploaders. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107222 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-107222?

Check whether you run github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107222 · Severity: medium · CVSS 6.5 · Published 2026-10-07

Excelize is a Go library for reading and writing Excel spreadsheets. A malformed Excel file with missing or empty conditional formatting sub-elements can cause the GetConditionalFormats function to crash. An attacker who can provide a spreadsheet to a service using this library could trigger a denial-of-service condition.

Technologies: github.com/xuri/excelize/v2 (Go), Xuri Excelize. Vendors: Go, Xuri.

Quick answers

Is CVE-2026-107222 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107222 being exploited in the wild.
How severe is CVE-2026-107222?: Medium severity, with a CVSS score of 6.5, published 7 October 2026.
Which products and versions are affected?: github.com/xuri/excelize/v2 (Go) >= 2.7.0, < 2.11.1-0.20260812075026-be7a16390fa6, SEMVER:introduced=2.7.0,fixed=2.11.1-0.20260812075026-be7a16390fa6; Xuri Excelize up to and including v2.11.0.
Is there a fix for CVE-2026-107222?: Yes. github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260812075026-be7a16390fa6 or later. Until then: Wrap calls to GetConditionalFormats in a recover block to handle panics gracefully, or restrict the source of Excel files processed by the application to trusted uploaders. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107222 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107222?: Check whether you run github.com/xuri/excelize/v2 (Go) or Xuri Excelize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/xuri/excelize/v2 (Go): upgrade to 2.11.1-0.20260812075026-be7a16390fa6 or later
```
go get github.com/xuri/excelize/v2@v2.11.1-0.20260812075026-be7a16390fa6
```

Wrap calls to GetConditionalFormats in a recover block to handle panics gracefully, or restrict the source of Excel files processed by the application to trusted uploaders.

Technical details

The GetConditionalFormats function in styles.go fails to validate the length and presence of child elements in conditional formatting rules before indexing them. Three rule types are affected: cellIs (missing formula element), colorScale (missing or nil colorScale element, or insufficient Cfvo children), and dataBar (insufficient Cfvo or Color children). An attacker can craft a malformed XLSX file with these missing elements, triggering an index out of bounds panic or nil pointer dereference without authentication or user interaction beyond the service opening the file.

Affected products

xuri Excelize up to and including v2.11.0

Identifiers

CVE-2026-107222
GHSA-rxcj-4pj5-74gr
GO-2026-6682

Timeline

2026-10-07: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.