CVE-2026-107222: Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check

October 7, 2026

GetConditionalFormats reads sub-elements of a <cfRule> straight out of xl/worksheets/sheetN.xml and indexes them without checking length, and in one case without checking for nil. Three rule types are affected: cellIs, dataBar and colorScale. A workbook with a rule that is missing a child a real Excel file would always have panics the call.

References

github.com/advisories/GHSA-rxcj-4pj5-74gr
github.com/qax-os/excelize/commit/be7a16390fa69c71d3ca618c741d1a2b5ed362cd
github.com/qax-os/excelize/pull/2375
github.com/qax-os/excelize/security/advisories/GHSA-rxcj-4pj5-74gr
nvd.nist.gov/vuln/detail/CVE-2026-107222

Code Behaviors & Features

Detect and mitigate CVE-2026-107222 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →