CVE-2026-107220: Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref

October 7, 2026

A worksheet containing <mergeCell ref=""/> makes mergeCellsParser leave the cached rectangle empty, and cellInRange then indexes that empty slice without a length check. Every non-streaming cell API panics with index out of range [0] with length 0 on the first cell read after opening the file.

References

github.com/advisories/GHSA-g27h-8qhm-6pff
github.com/qax-os/excelize/commit/99903a3240e58a47ff28fb8e05a03bd9d496ec24
github.com/qax-os/excelize/pull/2379
github.com/qax-os/excelize/security/advisories/GHSA-g27h-8qhm-6pff
nvd.nist.gov/vuln/detail/CVE-2026-107220

Code Behaviors & Features

Detect and mitigate CVE-2026-107220 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →