CVE-2026-59162: qax-os Excelize panic in GetCellValue via negative shared-string index

Executive brief

Excelize is a Go library for reading and writing spreadsheet files in XLSX format. A malicious XLSX file with a negative shared-string cell index can cause the application to crash when reading cell values via common APIs like GetCellValue or GetRows, denying service to legitimate users.

Technical details

The vulnerability is an uncaught exception in the xlsxC.getValueFrom() function. When processing XLSX cells with the shared-string type (t="s"), the code parses the cell value as an integer index and validates only that len(d.SI) > xlsxSI, omitting a lower-bound check for negative indices. A malicious XLSX workbook containing a cell with &lt;v&gt;-1&lt;/v&gt; will cause a panic during GetCellValue() or GetRows() calls without explicit panic recovery. The attack requires the victim application to process an attacker-supplied XLSX file. The fix, released in v2.11.0, adds a bounds check: if xlsxSI >= 0 && xlsxSI < len(d.SI).

Affected products

• xuri excelize <= 1.4.0
• xuri excelize/v2 < 2.11.0

Timeline

• 2026-09-10: disclosed: Vulnerability published to GitHub Advisory Database
• 2026-06-21: patched: Patch released in v2.11.0 (commit 93f0b3c)

References

• https://api.github.com/users/DavidCarliez
• https://github.com/DavidCarliez
• https://api.github.com/users/DavidCarliez/gists%7B/gist_id%7D
• https://api.github.com/users/DavidCarliez/repos
• https://avatars.githubusercontent.com/u/271374756?v=4
• https://api.github.com/users/DavidCarliez/events%7B/privacy%7D