CVE-2026-59162High· 7.5▾ TwilightExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice,…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.7%
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with -1 to trigger sharedStrings[-1] and panic when read through GetCellValue or GetRows. This issue is fixed in version 2.11.0.
excelize < 2.11.0Upgrade past the affected range:
excelize 2.11.0Affected packages:
github.com/xuri/excelize/v2 < 2.11.0github.com/xuri/excelize <= 1.4.0Patched in:
github.com/xuri/excelize/v2 2.11.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-59161High· 7.5Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets
CVE-2026-52856High· 7.5Wings is the server control plane for Pterodactyl, a free, open-source game server management panel
CVE-2026-82410High· 8.7Pocketbase is an open source web backend written in go
CVE-2026-88015Medium· 5.3rclone is a command-line program to sync files and directories to and from different cloud storage providers
CVE-2026-89090Medium· 5.9An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response …
CVE-2024-51744Low· 3.1golang-jwt: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (CVE-2024-517…