{"id":"EUVD-2026-94552","revision":null,"records":[{"revision":"f8d7973353a94db69480ae653e912402","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107222","aliases":[],"title":"Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormats reaches extractCondFmtCellIs and also indexes ColorScale.Cfvo, DataBar.Cfvo, and DataBar.Color without complete structural checks. When a crafted worksheet supplies a cellIs, dataBar, or colorScale rule missing expected children and the application calls GetConditionalFormats, missing formula, color, value-object, or colorScale data reaches an out-of-range index or nil dereference, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review.","state":0,"publishedAt":"2026-10-07T18:45:20.249+00:00","modifiedAt":"2026-10-08T16:09:37.888+00:00","affected":[{"ecosystem":"Vendor product","name":"excelize","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"qax-os\",\n                    \"product\": \"excelize\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 2.7.0, <= 2.11.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/qax-os/excelize/security/advisories/GHSA-rxcj-4pj5-74gr","https://github.com/qax-os/excelize/pull/2375","https://github.com/qax-os/excelize/commit/be7a16390fa69c71d3ca618c741d1a2b5ed362cd"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107222","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107222","identifiers":["CVE-2026-107222"]},"retained":false,"historicalAffected":[]},{"revision":"1885b31b4a124d49bcbcfa8956992b3d","observedAt":"2026-11-09T05:07:28.624+00:00","statement":{"source":"euvd","id":"EUVD-2026-94552","aliases":["CVE-2026-107222","GHSA-rxcj-4pj5-74gr"],"title":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malfor…","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormats reaches extractCondFmtCellIs and also indexes ColorScale.Cfvo, DataBar.Cfvo, and DataBar.Color without complete structural checks. When a crafted worksheet supplies a cellIs, dataBar, or colorScale rule missing expected children and the application calls GetConditionalFormats, missing formula, color, value-object, or colorScale data reaches an out-of-range index or nil dereference, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","score":6.5,"severity":null}],"references":["https://github.com/qax-os/excelize/security/advisories/GHSA-rxcj-4pj5-74gr","https://github.com/qax-os/excelize/pull/2375","https://github.com/qax-os/excelize/commit/be7a16390fa69c71d3ca618c741d1a2b5ed362cd"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-94552","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 7, 2026, 6:45:20 PM","dateUpdated":"Oct 8, 2026, 4:09:37 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-94552","identifiers":["EUVD-2026-94552","CVE-2026-107222","GHSA-rxcj-4pj5-74gr"]},"retained":false,"historicalAffected":[]},{"revision":"3676279805114495887d3f8afbe3c097","observedAt":"2026-10-25T04:17:41.466+00:00","statement":{"source":"nvd","id":"CVE-2026-107222","aliases":[],"title":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malfor…","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormats reaches extractCondFmtCellIs and also indexes ColorScale.Cfvo, DataBar.Cfvo, and DataBar.Color without complete structural checks. When a crafted worksheet supplies a cellIs, dataBar, or colorScale rule missing expected children and the application calls GetConditionalFormats, missing formula, color, value-object, or colorScale data reaches an out-of-range index or nil dereference, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review.","state":0,"publishedAt":"2026-10-07T19:17:34.8+00:00","modifiedAt":"2026-10-13T14:18:54.72+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/qax-os/excelize/commit/be7a16390fa69c71d3ca618c741d1a2b5ed362cd","https://github.com/qax-os/excelize/pull/2375","https://github.com/qax-os/excelize/security/advisories/GHSA-rxcj-4pj5-74gr"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107222","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-129","CWE-476"],"productCriteria":["cpe:2.3:a:excelize:excelize:*:*:*:*:*:go:*:*"],"sourceDates":{"published":"2026-10-07T19:17:34.800","lastModified":"2026-10-13T14:18:54.720"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-107222","identifiers":["CVE-2026-107222"]},"retained":false,"historicalAffected":[]},{"revision":"39fbd23d18fb47e68a568021bed059cc","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GHSA-rxcj-4pj5-74gr","aliases":["CVE-2026-107222","GO-2026-6682"],"title":"Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check","description":"## Summary\n\n`GetConditionalFormats` reads sub-elements of a `<cfRule>` straight out of `xl/worksheets/sheetN.xml` and indexes them without checking length, and in one case without checking for nil. Three rule types are affected: `cellIs`, `dataBar` and `colorScale`. A workbook with a rule that is missing a child a real Excel file would always have panics the call.\n\n## Where it is\n\nAll three sinks are in `styles.go`, at the same line numbers in v2.11.0 and on master `d552a7e`. All three are reached from `GetConditionalFormats` through `styles.go:3271`.\n\n`styles.go:3003`, in `extractCondFmtCellIs`:\n\n```go\n\tformat.Value = c.Formula[0]\n```\n\nThe branch above it handles `len(c.Formula) == 2`; this one is the fallback and does not check that there is a formula at all, so a `cellIs` rule with no `<formula>` child indexes an empty slice.\n\n`styles.go:3132`, in the colorScale extractor:\n\n```go\n\tvalues := len(c.ColorScale.Cfvo)\n```\n\n`c.ColorScale` is a `*xlsxColorScale` and is nil when the `<cfRule type=\"colorScale\">` element has no `<colorScale>` child. Lines 3148 and 3153 then index `Cfvo[1]` and `Cfvo[2]` in the three-colour branch with no length check either.\n\n`styles.go:3186`, `:3188` and `:3190`, in the dataBar extractor:\n\n```go\n\t\tformat.MinType = c.DataBar.Cfvo[0].Type\n\t\t...\n\t\tformat.BarColor = \"#\" + f.getThemeColor(c.DataBar.Color[0])\n```\n\nThe guard here is `c.DataBar != nil`, which says nothing about the length of `Cfvo` or `Color`, so an empty `<dataBar></dataBar>` element reaches all three.\n\n## Who the attacker is\n\nAnyone who can hand a spreadsheet to a service that opens it and calls `GetConditionalFormats`. No authentication, no user interaction beyond the service doing its normal job, and the file is small.\n\n## Reproduction\n\nThree minimal `.xlsx` files were built, each a real zip with `[Content_Types].xml`, `_rels/.rels`, `xl/workbook.xml`, `xl/_rels/workbook.xml.rels` and one worksheet, opened each with the public `excelize.OpenReader` and called `GetConditionalFormats(\"Sheet1\")`. Nothing internal is touched.\n\nThe worksheet fragment for the `cellIs` case, note there is no `<formula>` child:\n\n```xml\n<conditionalFormatting sqref=\"A1\"><cfRule type=\"cellIs\" operator=\"equal\" priority=\"1\" dxfId=\"0\"/></conditionalFormatting>\n```\n\nfor `dataBar`:\n\n```xml\n<conditionalFormatting sqref=\"A1\"><cfRule type=\"dataBar\" priority=\"1\"><dataBar></dataBar></cfRule></conditionalFormatting>\n```\n\nand for `colorScale`:\n\n```xml\n<conditionalFormatting sqref=\"A1\"><cfRule type=\"colorScale\" priority=\"1\"/></conditionalFormatting>\n```\n\nObserved against master `d552a7e` on go1.26.5:\n\n```text\ncellIs      panic: runtime error: index out of range [0] with length 0\n              styles.go:3003\n              styles.go:1217\n              styles.go:3271\n\ndataBar     panic: runtime error: index out of range [0] with length 0\n              styles.go:3186\n              styles.go:1262\n              styles.go:3271\n\ncolorScale  panic: runtime error: invalid memory address or nil pointer dereference\n              styles.go:3132\n              styles.go:1259\n              styles.go:3271\n```\n\nOne honesty note on impact. These are ordinary Go panics, not fatal errors, so a caller that wraps the call in `recover` survives them.\n\n## Suggested fix\n\nLength-check `c.Formula` before line 3003 and return the rule with an empty value when there is no formula. Nil-check `c.ColorScale` before line 3132 and length-check `ColorScale.Cfvo` before indexing 1 and 2. Length-check `DataBar.Cfvo` and `DataBar.Color` alongside the existing nil check at 3186 to 3190. Skipping the malformed rule rather than erroring would keep `GetConditionalFormats` usable on files that are merely sloppy.\n\n## Affected versions\n\n`github.com/xuri/excelize/v2` up to and including v2.11.0, and master at `d552a7e`. I read the three sinks at tag v2.11.0 and at master and ran the reproducers against master.","state":0,"publishedAt":"2026-10-07T20:22:54+00:00","modifiedAt":"2026-11-05T23:25:39.2186148+00:00","affected":[{"ecosystem":"Go","name":"github.com/xuri/excelize/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.7.0"},{"kind":"fixed","version":"2.11.1-0.20260812075026-be7a16390fa6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/qax-os/excelize/security/advisories/GHSA-rxcj-4pj5-74gr","https://github.com/qax-os/excelize/pull/2375","https://github.com/qax-os/excelize/commit/be7a16390fa69c71d3ca618c741d1a2b5ed362cd","https://github.com/qax-os/excelize"],"sourceUrl":"https://github.com/advisories/GHSA-rxcj-4pj5-74gr","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-rxcj-4pj5-74gr","identifiers":["GHSA-rxcj-4pj5-74gr","CVE-2026-107222","GO-2026-6682"]},"retained":false,"historicalAffected":[]},{"revision":"61bf1bf0625f4702a6fb7fded833d83a","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GO-2026-6682","aliases":["CVE-2026-107222","GHSA-rxcj-4pj5-74gr"],"title":"GetConditionalFormats indexes conditional-formatting rule sub-elements with no length / nil check in github.com/xuri/excelize","description":"GetConditionalFormats indexes conditional-formatting rule sub-elements with no length / nil check in github.com/xuri/excelize","state":0,"publishedAt":"2026-11-05T22:53:46+00:00","modifiedAt":"2026-11-05T23:15:11.8891758+00:00","affected":[{"ecosystem":"Go","name":"github.com/xuri/excelize/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.7.0"},{"kind":"fixed","version":"2.11.1-0.20260812075026-be7a16390fa6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/qax-os/excelize/security/advisories/GHSA-rxcj-4pj5-74gr","https://github.com/qax-os/excelize/commit/be7a16390fa69c71d3ca618c741d1a2b5ed362cd","https://github.com/qax-os/excelize/pull/2375"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6682","license":"OSV · upstream source license applies","key":"osv:GO-2026-6682","identifiers":["GO-2026-6682","CVE-2026-107222","GHSA-rxcj-4pj5-74gr"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T08:21:42.9806814+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T08:21:42.9806814+00:00","lastSuccessAt":"2026-11-10T08:21:49.9716687+00:00","error":null,"lastVerifiedAt":"2026-11-10T08:21:49.9722477+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-746bb7faca3153abeb3c809473890793eb06eef475a9980d578ad522a2f91b4d","complete":true,"records":421910,"lastAttemptAt":"2026-11-10T08:21:35.2839989+00:00","lastSuccessAt":"2026-11-10T08:02:16.532381+00:00","error":null,"lastVerifiedAt":"2026-11-10T08:21:35.2839989+00:00","snapshotPublishedAt":"2026-11-10T07:28:26+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2e6a476534094233b48f2f0b6da5cf35","complete":true,"records":13689,"lastAttemptAt":"2026-11-10T08:22:41.0210911+00:00","lastSuccessAt":"2026-11-10T06:05:35.03+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:05:35.03+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13742,"expectedIdentifiers":13742,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T08:21:42.9806814+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T08:21:42.9806814+00:00","lastSuccessAt":"2026-11-10T08:22:06.2444793+00:00","error":null,"lastVerifiedAt":"2026-11-10T08:22:06.2444805+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-78b08a98b3ce49f188246fb2aae3c44d","complete":false,"records":13695,"lastAttemptAt":"2026-11-10T08:22:40.320966+00:00","lastSuccessAt":"2026-11-10T08:22:40.318+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T08:22:40.318+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13742,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T08:21:42.331385+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T08:21:42.331385+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T08:21:38.6986948+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T08:21:38.6986948+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-94169eec81ea3989aa551092397ff34ae53c104b4a6ce646e1524452e4ab2a39","complete":true,"records":3065,"lastAttemptAt":"2026-11-10T08:21:42.4406049+00:00","lastSuccessAt":"2026-11-10T08:04:45.5923716+00:00","error":null,"lastVerifiedAt":"2026-11-10T08:21:42.4406049+00:00","snapshotPublishedAt":"2026-11-10T06:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-4331051b0b2d4ccdbdca3aa196b0be3818a465064a4b18dde4cf39c2250eb490","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T08:21:40.047287+00:00","lastSuccessAt":"2026-11-10T08:04:37.1757322+00:00","error":null,"lastVerifiedAt":"2026-11-10T08:21:40.047287+00:00","snapshotPublishedAt":"2026-11-10T07:33:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}