Threats tagged 'ghsa-5h23-36rv-pm65'

CVE-2026-107225 is an improper input validation vulnerability in the Go library excelize versions 2.8.0 through 2.11.0. The vulnerability arises because the GetStyle function's predicates only check upper bounds for style-table indices, allowing negative indices to be used. When a crafted styles.xml file contains negative fillId, borderId, or fontId values, these negative values bypass the upper-bound checks and cause negative slice indexing, leading to a panic during cell styling reads. No fix is currently available for this issue.