CVE-2026-59162High· 7.5▾ TwilightExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice,…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
0.4% → 0.7%
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with -1 to trigger sharedStrings[-1] and panic when read through GetCellValue or GetRows. This issue is fixed in version 2.11.0.
excelize < 2.11.0Upgrade past the affected range:
excelize 2.11.0Affected packages:
github.com/xuri/excelize/v2 < 2.11.0github.com/xuri/excelize <= 1.4.0Patched in:
github.com/xuri/excelize/v2 2.11.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-59161High· 7.5Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets
CVE-2026-107214High· 7.5Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets
CVE-2026-107222Medium· 6.5Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets
CVE-2026-107223High· 7.5Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets
CVE-2026-107224Medium· 6.5Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets
CVE-2026-107225Medium· 6.5Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets