{"id":"GO-2026-6684","revision":"b9d1f36ec8d844b4b33432cccade9ade","records":[{"revision":"b9d1f36ec8d844b4b33432cccade9ade","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6684","aliases":["CVE-2026-107214","GHSA-2j4c-ffch-9f23"],"title":"Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks in github.com/xuri/excelize","description":"Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks in github.com/xuri/excelize","state":0,"publishedAt":"2026-10-19T21:08:21+00:00","modifiedAt":"2026-10-19T21:31:35.7028999+00:00","affected":[{"ecosystem":"Go","name":"github.com/360EntSecGroup-Skylar/excelize/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.3.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/xuri/excelize/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.11.1-0.20260915055537-22f76f9acb94"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/qax-os/excelize/security/advisories/GHSA-2j4c-ffch-9f23","https://github.com/qax-os/excelize/commit/22f76f9acb94b85b3eb9c4365ab4f750cebbc565","https://github.com/qax-os/excelize/pull/2395"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6684","license":"OSV · upstream source license applies","key":"osv:GO-2026-6684","identifiers":["GO-2026-6684","CVE-2026-107214","GHSA-2j4c-ffch-9f23"]},"retained":false,"historicalAffected":[]}],"coverage":[]}