{"id":"GO-2026-6452","revision":"e36fb380626840718c0a72d995e845bb","records":[{"revision":"e36fb380626840718c0a72d995e845bb","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6452","aliases":["CVE-2026-59162","GHSA-fx5j-qcqg-grpf"],"title":"Panic via negative shared-string index in github.com/xuri/excelize","description":"In github.com/xuri/excelize/v2, parsing a spreadsheet cell with a negative shared-string index causes a runtime panic. The shared-string lookup in xlsxC.getValueFrom checks only the upper bound of the parsed index against the shared-string slice length, causing negative indices (such as -1) to bypass validation and trigger an out-of-bounds slice access when reading cells via APIs such as GetCellValue or GetRows.","state":0,"publishedAt":"2026-09-16T18:00:43+00:00","modifiedAt":"2026-09-24T20:30:11.136976+00:00","affected":[{"ecosystem":"Go","name":"github.com/xuri/excelize/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.11.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/qax-os/excelize/security/advisories/GHSA-fx5j-qcqg-grpf","https://github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453","https://github.com/qax-os/excelize/pull/2331","https://github.com/qax-os/excelize/releases/tag/v2.11.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6452","license":"OSV · upstream source license applies","key":"osv:GO-2026-6452","identifiers":["GO-2026-6452","CVE-2026-59162","GHSA-fx5j-qcqg-grpf"]},"retained":false,"historicalAffected":[]}],"coverage":[]}