CVE-2026-59161: Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation
Excelize’s prior row-bound fix for GHSA-h69g / CVE-2026-54063 protects the checked worksheet parser, but the streaming worksheet reader used by Rows and GetRows does not enforce the same TotalRows bound on the row r attribute. A small XLSX file can set a row number above Excelize’s maximum row (1048576) and omit the cell coordinate. GetRows then appends empty rows up to the attacker-controlled row index and returns success.
This was reproduced on the current default branch commit 1213a8bd7c5ab360554603ac5c995ccaf6eb4314 and the latest release tag v2.10.1 (5ad5ab3af0054c55bdce09f1530085600e9f2e45).
References
- github.com/advisories/GHSA-q5j5-6p94-4gwc
- github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453
- github.com/qax-os/excelize/pull/2331
- github.com/qax-os/excelize/releases/tag/v2.11.0
- github.com/qax-os/excelize/security/advisories/GHSA-q5j5-6p94-4gwc
- nvd.nist.gov/vuln/detail/CVE-2026-59161
Code Behaviors & Features
Detect and mitigate CVE-2026-59161 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →