fkie_cve-2026-107222

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormats reaches extractCondFmtCellIs and also indexes ColorScale.Cfvo, DataBar.Cfvo, and DataBar.Color without complete structural checks. When a crafted worksheet supplies a cellIs, dataBar, or colorScale rule missing expected children and the application calls GetConditionalFormats, missing formula, color, value-object, or colorScale data reaches an out-of-range index or nil dereference, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review.

GHSA-rxcj-4pj5-74gr — Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check

Affected: Go: github.com/xuri/excelize/v2

## Summary

`GetConditionalFormats` reads sub-elements of a `<cfRule>` straight out of `xl/worksheets/sheetN.xml` and indexes them without checking length, and in one case without checking for nil. Three rule types are affected: `cellIs`, `dataBar` and `colorScale`. A workbook with a rule that is missing a child a real Excel file would always have panics the call.

## Where it is

All three sinks are in `styles.go`, at the same line numbers in v2.11.0 and on master `d552a7e`. All three are reached from `GetConditionalFormats` through `styles.go:3271`.

`styles.go:3003`, in `extractCondFmtCellIs`:

```go format.Value = c.Formula[0] ```

The branch above it handles `len(c.Formula) == 2`; this one is the fallback and does not check that there is a formula at all, so a `cellIs` rule with no `<formula>` child indexes an empty slice.

`styles.go:3132`, in the colorScale extractor:

```go values := len(c.ColorScale.Cfvo) ```

`c.ColorScale` is a `*xlsxColorScale` and is nil when the `<cfRule type="colorScale">` element has no `<colorScale>` child. Lines 3148 and 3153 then index `Cfvo[1]` and `Cfvo[2]` in the three-colour branch with no length check either.

`styles.go:3186`, `:3188` and `:3190`, in the dataBar extractor:

```go format.MinType = c.DataBar.Cfvo[0].Type ... format.BarColor = "#" + f.getThemeColor(c.DataBar.Color[0]) ```

The guard here is `c.DataBar != nil`, which says nothing about the length of `Cfvo` or `Color`, so an empty `<dataBar></dataBar>` element rea…

Most recent entries from all

fkie_cve-2026-107222

GHSA-rxcj-4pj5-74gr — Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check