MEDIUM GitHub
CVE-2026-59162
Excelize: Negative shared-string index causes panic in GetCellValue and GetRows
# Negative shared-string index causes panic in GetCellValue and GetRows
## Summary
Excelize parses shared-string cell values with `strconv.Atoi` and checks only the upper bound before indexing the shared string slice. If an XLSX file contains a shared-string cell with `<v>-1</v>`, the parsed index is negative. The upper-bound check still passes (`len(sharedStrings) > -1`), and Excelize indexes `sharedStrings[-1]`, causing a runtime panic.
This was reproduced on the current default branch comm
Affected Products
- go/github.com/xuri/excelize/v2 < 2.11.0
- go/github.com/xuri/excelize <= 1.4.0
References
- https://github.com/advisories/GHSA-fx5j-qcqg-grpf
- https://github.com/qax-os/excelize/security/advisories/GHSA-fx5j-qcqg-grpf
- https://nvd.nist.gov/vuln/detail/CVE-2026-59162
- https://github.com/qax-os/excelize/pull/2331
This medium severity vulnerability was published on 2026-09-10 via GitHub. Affected: go/github.com/xuri/excelize/v2 < 2.11.0, go/github.com/xuri/excelize <= 1.4.0.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.