CVE-2026-59162

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with -1 to trigger sharedStrings[-1] and panic when read through GetCellValue or GetRows. This issue is fixed in version 2.11.0.

• CWE-248
• CWE-755

• https://github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453Patch
• https://github.com/qax-os/excelize/pull/2331Issue Tracking, Patch
• https://github.com/qax-os/excelize/releases/tag/v2.11.0Release Notes
• https://github.com/qax-os/excelize/security/advisories/GHSA-fx5j-qcqg-grpfExploit, Vendor Advisory
• https://github.com/qax-os/excelize/security/advisories/GHSA-fx5j-qcqg-grpfExploit, Vendor Advisory

Published

Jul 10, 2026

Last Modified

Jul 16, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59154Wekan is open source kanban built with Meteor. Prior to 9.64…4.3
• CVE-2026-59155Nezha Monitoring is a self-hostable, lightweight, servers an…6.9
• CVE-2026-59156OpenImageIO is a toolset for reading, writing, and manipulat…6.5
• CVE-2026-59157webhookd is a minimalist webhook server that triggers shell …6.5
• CVE-2026-59160Yeger is a monorepo for npm packages maintained under the ye…8.8
• CVE-2026-59161Excelize is a Go language library for reading and writing Mi…7.5
• CVE-2026-59163Mnemosyne is a memory layer for artificial intelligence agen…9.1
• CVE-2026-59167SunEditor is a lightweight and powerful WYSIWYG editor in va…10
• CVE-2026-59168Dasel is a command-line tool and library for querying, modif…6.2
• CVE-2026-5917libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built w…8.8
• CVE-2026-59173Uncontrolled Resource Consumption vulnerability in Apache Tr…7.5
• CVE-2026-59178ESPHome Device Builder Dashboard is a dashboard for the ESPH…9.8