CVE-2026-59162: Excelize: Negative shared-string index causes panic in GetCellValue and GetRows
Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice. If an XLSX file contains a shared-string cell with <v>-1</v>, the parsed index is negative. The upper-bound check still passes (len(sharedStrings) > -1), and Excelize indexes sharedStrings[-1], causing a runtime panic.
This was reproduced on the current default branch commit 1213a8bd7c5ab360554603ac5c995ccaf6eb4314 and the latest release tag v2.10.1 (5ad5ab3af0054c55bdce09f1530085600e9f2e45). The issue is independent from the row-bound allocation report, so I am reporting it separately.
References
- github.com/advisories/GHSA-fx5j-qcqg-grpf
- github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453
- github.com/qax-os/excelize/pull/2331
- github.com/qax-os/excelize/releases/tag/v2.11.0
- github.com/qax-os/excelize/security/advisories/GHSA-fx5j-qcqg-grpf
- nvd.nist.gov/vuln/detail/CVE-2026-59162
Code Behaviors & Features
Detect and mitigate CVE-2026-59162 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →