EXECUTIVE SUMMARY:
Two vulnerabilities in the github.com/xuri/excelize/v2 package allow malicious XLSX files to trigger denial-of-service conditions when processed by applications using Excelize. The first vulnerability allows a negative shared-string index to cause a runtime panic in GetCellValue and GetRows, while the second allows an attacker-controlled row number to force GetRows to allocate excessive memory and CPU resources. Both issues affect the tested package and current default branch at the time of reporting, with no fixed release known at the time of the reports.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
Two vulnerabilities in the github.com/xuri/excelize/v2 package allow malicious XLSX files to trigger denial-of-service conditions when processed by applications using Excelize. The first vulnerability allows a negative shared-string index to cause a runtime panic in GetCellValue and GetRows, while the second allows an attacker-controlled row number to force GetRows to allocate excessive memory and CPU resources. Both issues affect the tested package and current default branch at the time of reporting, with no fixed release known at the time of the reports.[emaillocker id="1283"]
CVE-2026-59162 (CVSS 6.9 — Medium): A vulnerability in github.com/xuri/excelize/v2 allows malicious XLSX files containing negative shared-string indexes to trigger a runtime panic in GetCellValue and GetRows, potentially causing denial of service.
CVE-2026-59161 (CVSS 8.7 — High): A vulnerability in github.com/xuri/excelize/v2 allows malicious XLSX files to bypass row-bound validation and cause GetRows to allocate excessive memory and CPU resources, potentially resulting in denial of service.
RECOMMENDATIONS:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-fx5j-qcqg-grpf
https://github.com/advisories/GHSA-q5j5-6p94-4gwc