HIGH GitHub
CVE-2026-59161
Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation
# Streaming GetRows row-bound bypass causes attacker-controlled allocation
## Summary
Excelize's prior row-bound fix for GHSA-h69g / CVE-2026-54063 protects the checked worksheet parser, but the streaming worksheet reader used by `Rows` and `GetRows` does not enforce the same `TotalRows` bound on the row `r` attribute. A small XLSX file can set a row number above Excelize's maximum row (`1048576`) and omit the cell coordinate. `GetRows` then appends empty rows up to the attacker-controlled row
Affected Products
- go/github.com/xuri/excelize/v2 < 2.11.0
- go/github.com/xuri/excelize <= 1.4.0
References
- https://github.com/advisories/GHSA-q5j5-6p94-4gwc
- https://github.com/qax-os/excelize/security/advisories/GHSA-q5j5-6p94-4gwc
- https://nvd.nist.gov/vuln/detail/CVE-2026-59161
- https://github.com/qax-os/excelize/pull/2331
This high severity vulnerability was published on 2026-09-10 via GitHub. Affected: go/github.com/xuri/excelize/v2 < 2.11.0, go/github.com/xuri/excelize <= 1.4.0.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.