{"id":"EUVD-2026-42937","enisaUuid":"5d00baa2-f56f-3247-a2c7-4f23c429adf3","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with -1 to trigger sharedStrings[-1] and panic when read through GetCellValue or GetRows. This issue is fixed in version 2.11.0.","datePublished":"Jul 10, 2026, 3:51:26 PM","dateUpdated":"Jul 10, 2026, 6:40:25 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/qax-os/excelize/security/advisories/GHSA-fx5j-qcqg-grpf\nhttps://github.com/qax-os/excelize/pull/2331\nhttps://github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453\nhttps://github.com/qax-os/excelize/releases/tag/v2.11.0\n","aliases":"CVE-2026-59162\nGHSA-fx5j-qcqg-grpf\n","assigner":"GitHub_M","epss":0.66,"enisaIdProduct":[{"id":"831a3794-9b4b-3142-b221-7ffbc2d04349","product":{"name":"excelize","vendor":{"name":"qax-os"}},"product_version":"\u003c 2.11.0"}],"enisaIdVendor":[{"id":"066deef2-3aad-3818-9f0e-dd2b81e5a276","vendor":{"name":"qax-os"}}],"enisaIdVulnerability":[{"id":"50b2d71e-0257-303a-8fb0-c310a473c643","vulnerability":{"id":"GHSA-fx5j-qcqg-grpf","description":"Excelize: Negative shared-string index causes panic in GetCellValue and GetRows","datePublished":"Sep 10, 2026, 3:08:53 PM","dateUpdated":"Sep 10, 2026, 3:08:53 PM","baseScore":0.0,"references":"https://github.com/qax-os/excelize/security/advisories/GHSA-fx5j-qcqg-grpf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59162\nhttps://github.com/qax-os/excelize/pull/2331\nhttps://github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453\nhttps://github.com/qax-os/excelize\nhttps://github.com/qax-os/excelize/releases/tag/v2.11.0\n","enisa_id":"EUVD-2026-42937\n","aliases":"CVE-2026-59162\nGHSA-fx5j-qcqg-grpf\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"89ab1669-d9aa-3da0-ab80-e01d81db393b","vulnerability":{"id":"CVE-2026-59162","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with -1 to trigger sharedStrings[-1] and panic when read through GetCellValue or GetRows. This issue is fixed in version 2.11.0.","datePublished":"Jul 10, 2026, 3:51:26 PM","dateUpdated":"Jul 10, 2026, 6:40:25 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/qax-os/excelize/security/advisories/GHSA-fx5j-qcqg-grpf\nhttps://github.com/qax-os/excelize/pull/2331\nhttps://github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453\nhttps://github.com/qax-os/excelize/releases/tag/v2.11.0\n","enisa_id":"EUVD-2026-42937\n","assigner":"GitHub_M","epss":0.66,"dataProcessed":"Nov 3, 2026, 7:17:50 AM","vulnerabilityProduct":[{"id":"43bbac05-1e88-3d00-af8e-63c2de2af31e","product":{"name":"excelize","vendor":{"name":"qax-os"}},"product_version":"\u003c 2.11.0"}],"vulnerabilityVendor":[{"id":"c54914ee-8d7f-38ad-85b6-93aca3d5e41d","vendor":{"name":"qax-os"}}]}}],"enisaIdAdvisory":[]}