Vulnerability in github.com/xuri/excelize/v2 (CVE-2026-107224)
Summary
Vulnerability in github.com/xuri/excelize/v2 (CVE-2026-107224). Risk of unauthorized operations or information disclosure. Exploitable via int64. Mitigation: upgrade to 2.11.1-0.20260805032953-db93f8d89de7 or later.
Original description
The description as published by the source.
Summary
A Zip64 uncompressed-size of 2^63 casts to a negative int64 that bypasses the unzip-size guard and reaches make([]byte, 0, negativeCap)
A Zip64 uncompressed-size in the range [2^63, 2^64) casts to a negative int64 in zip.File.FileInfo().Size(), and ReadZipReader does signed arithmetic on that value, so the total-decompression guard is bypassed and the negative size reaches make([]byte, 0, size) in readFile. A 159-byte crafted file panics OpenFile and OpenReader with runtime error: makeslice: cap out of range.
The guard, at lib.go:44-46 on HEAD ae2113b:
fileSize := v.FileInfo().Size()
unzipSize += fileSize
if unzipSize > f.options.UnzipSizeLimit {
return fileList, worksheets, newUnzipSizeLimitError(f.options.UnzipSizeLimit)
}
FileInfo().Size() returns int64(UncompressedSize64). UncompressedSize64 is read from the Zip64 extended-information extra record in the central directory and is fully attacker controlled, so any value with the top bit set arrives as a negative int64. unzipSize then goes negative and the comparison against UnzipSizeLimit (default 1000 << 24, templates.go:193) is false no matter how many such entries the archive contains.
The same negative value also fails the two stream-to-temp checks at lib.go:53 and lib.go:64 (fileSize > f.options.UnzipXMLSizeLimit), so the entry is not diverted to a temp file and control reaches readFile:
// lib.go:150
dat := make([]byte, 0, file.FileInfo().…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-107224 has been found in github.com/xuri/excelize/v2.
Attackers can target a specific entry point like int64 over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 6.5/10.
What to do: upgrade github.com/xuri/excelize/v2 to 2.11.1-0.20260805032953-db93f8d89de7 or later.
If unsure, ask your IT team or search "github.com/xuri/excelize/v2 CVE-2026-107224" on the vendor's site.
CVE-2026-107224 (github.com/xuri/excelize/v2) — CWE-190 / CVSS v3 6.5
Attack vector: remote (network-reachable) / unauthenticated
Attack surface: int64 / ReadZipReader / readFile / OpenFile
Patched: 2.11.1-0.20260805032953-db93f8d89de7 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-190) exists in github.com/xuri/excelize/v2. Attackers reach the vulnerable code path via int64 without authentication.
Check the vendor advisory for the affected versions of github.com/xuri/excelize/v2. Attack surface: int64 / ReadZipReader / readFile / OpenFile.
Severity: Medium (CVSS 6.5/10). Risk of unauthorized operations or information disclosure.
Update to 2.11.1-0.20260805032953-db93f8d89de7.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'github.com/xuri/excelize/v2' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'github.com/xuri/excelize/v2' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
github.com/xuri/excelize/v2を grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade github.com/xuri/excelize/v2 to 2.11.1-0.20260805032953-db93f8d89de7ステージング環境で 2.11.1-0.20260805032953-db93f8d89de7 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- package github.com
- web github.com
- web github.com
- web github.com
- web github.com