THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-fx5j-qcqg-grpf (medium) — Excelize: Negative shared-string index causes panic in GetCellValue and GetRows

[GHSA] GHSA-fx5j-qcqg-grpf (medium) — Excelize: Negative shared-string index causes panic in GetCellValue and GetRows

highgithub_advisoriesPublished 2026-09-10

GHSA-fx5j-qcqg-grpf Severity: medium CVE: CVE-2026-59162

Excelize: Negative shared-string index causes panic in GetCellValue and GetRows

# Negative shared-string index causes panic in GetCellValue and GetRows

## Summary

Excelize parses shared-string cell values with `strconv.Atoi` and checks only the upper bound before indexing the shared string slice. If an XLSX file contains a shared-string

Indicators of compromise

1213a8bd7c5ab360554603ac5c995ccaf6eb4314sha1
5ad5ab3af0054c55bdce09f1530085600e9f2e45sha1
CVE-2026-59162cve
http://schemas.openxmlformats.org/spreadsheetml/2006/mainurl

Original source: https://github.com/advisories/GHSA-fx5j-qcqg-grpf