GHSA-Q5J5-6P94-4GWC
Vulnerability from github – Published: 2026-09-10 15:09 – Updated: 2026-09-10 15:09
VLAI
Summary
Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation
Details
Streaming GetRows row-bound bypass causes attacker-controlled allocation
Summary
Excelize's prior row-bound fix for GHSA-h69g / CVE-2026-54063 protects the checked worksheet parser, but the streaming worksheet reader used by Rows and GetRows does not enforce the same TotalRows bound on the row r attribute. A small XLSX file can set a row number above Excelize's maximum row (1048576) and omit the cell coordinate. GetRows then appends empty rows up to the attacker-controlled row index and returns success.
This was reproduced on the current default branch commit 1213a8bd7c5ab360554603ac5c995ccaf6eb4314 and the latest release tag v2.10.1 (5ad5ab3af0054c55bdce09f1530085600e9f2e45).
Affected package
- Package:
github.com/xuri/excelize/v2 - Tested affected versions: current default branch at
1213a8bd7c5ab360554603ac5c995ccaf6eb4314, and releasev2.10.1 - Fixed version: none known at the time of this report
Impact
An attacker who can provide an XLSX file to an application that calls GetRows can cause memory and CPU usage to scale with an attacker-controlled row number, even though the file itself is tiny. This is an availability issue and appears to be an incomplete coverage variant of the GHSA-h69g row-index allocation class.
In the conservative PoC, row r="2000000" returned a [][]string with length 2,000,000 and allocated about 46 MB. Larger row numbers scale the allocation further.
Root cause
The checked parser path validates row numbers:
excelize.go:checkRowNum(r int)rejects negative rows and rows greater thanTotalRows.excelize.go:checkSheet()callscheckRowNum(r.R)before allocating sheet rows.workSheetReader()invokescheckSheet()/checkRow()before returning a cached worksheet.
The streaming path does not use that checked parser:
rows.go:Rows(sheet)opens an XML decoder directly.Rows.Next()accepts the rowrattribute and assigns it to the iterator's current row without applyingcheckRowNum().Rows.Columns()also assigns rowrto the iterator state without applyingcheckRowNum().GetRows()appends empty row slices for the gap between the previous row and the current row.
Because a cell without an r coordinate can still contain a value, the worksheet can avoid cell-coordinate row validation while still causing GetRows() to materialize rows up to the out-of-range row number.
Minimal worksheet payload
<?xml version="1.0" encoding="UTF-8"?>
<worksheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main">
<sheetData>
<row r="2000000"><c t="s"><v>0</v></c></row>
</sheetData>
</worksheet>
The workbook also contains a normal sharedStrings.xml with one string (ok).
Reproduction
A minimal Go harness creates the XLSX in memory and calls GetRows("Sheet1"):
rows, err := f.GetRows("Sheet1")
fmt.Println("rows_len:", len(rows))
if len(rows) > 0 {
fmt.Println("last_row:", rows[len(rows)-1])
}
fmt.Printf("returned error: %T %v\n", err, err)
Observed output on current default branch commit 1213a8bd7c5ab360554603ac5c995ccaf6eb4314:
== streaming GetRows row r=2000000 cell without r ==
rows_len: 2000000
last_row: [ok]
returned error: <nil> <nil>
elapsed=21ms alloc_delta=46MB
Observed output on latest release tag v2.10.1:
== streaming GetRows row r=2000000 cell without r ==
rows_len: 2000000
last_row: [ok]
returned error: <nil> <nil>
elapsed=14ms alloc_delta=46MB
A control using the checked parser with row r="1048577" and c r="A1048577" correctly returns row number exceeds maximum limit, confirming this report is about inconsistent enforcement in the streaming path rather than a missing global constant.
Expected behavior
Rows / GetRows should reject row numbers greater than TotalRows with the same error behavior as the checked parser path.
Suggested remediation
- Apply the same row-bound validation in the streaming reader immediately after parsing a row
rattribute. - Preserve and return row parsing errors from
GetRows()instead of silently continuing or returning onlyRows.Close()errors. - Add regression tests for
GetRows()on a worksheet containingrow r="1048577"with a cell value but no cellrcoordinate.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/xuri/excelize/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.11.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/xuri/excelize"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-59161"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-10T15:09:09Z",
"nvd_published_at": "2026-07-10T17:17:02Z",
"severity": "HIGH"
},
"details": "# Streaming GetRows row-bound bypass causes attacker-controlled allocation\n\n## Summary\n\nExcelize\u0027s prior row-bound fix for GHSA-h69g / CVE-2026-54063 protects the checked worksheet parser, but the streaming worksheet reader used by `Rows` and `GetRows` does not enforce the same `TotalRows` bound on the row `r` attribute. A small XLSX file can set a row number above Excelize\u0027s maximum row (`1048576`) and omit the cell coordinate. `GetRows` then appends empty rows up to the attacker-controlled row index and returns success.\n\nThis was reproduced on the current default branch commit `1213a8bd7c5ab360554603ac5c995ccaf6eb4314` and the latest release tag `v2.10.1` (`5ad5ab3af0054c55bdce09f1530085600e9f2e45`).\n\n## Affected package\n\n- Package: `github.com/xuri/excelize/v2`\n- Tested affected versions: current default branch at `1213a8bd7c5ab360554603ac5c995ccaf6eb4314`, and release `v2.10.1`\n- Fixed version: none known at the time of this report\n\n## Impact\n\nAn attacker who can provide an XLSX file to an application that calls `GetRows` can cause memory and CPU usage to scale with an attacker-controlled row number, even though the file itself is tiny. This is an availability issue and appears to be an incomplete coverage variant of the GHSA-h69g row-index allocation class.\n\nIn the conservative PoC, `row r=\"2000000\"` returned a `[][]string` with length 2,000,000 and allocated about 46 MB. Larger row numbers scale the allocation further.\n\n## Root cause\n\nThe checked parser path validates row numbers:\n\n- `excelize.go`: `checkRowNum(r int)` rejects negative rows and rows greater than `TotalRows`.\n- `excelize.go`: `checkSheet()` calls `checkRowNum(r.R)` before allocating sheet rows.\n- `workSheetReader()` invokes `checkSheet()` / `checkRow()` before returning a cached worksheet.\n\nThe streaming path does not use that checked parser:\n\n- `rows.go`: `Rows(sheet)` opens an XML decoder directly.\n- `Rows.Next()` accepts the row `r` attribute and assigns it to the iterator\u0027s current row without applying `checkRowNum()`.\n- `Rows.Columns()` also assigns row `r` to the iterator state without applying `checkRowNum()`.\n- `GetRows()` appends empty row slices for the gap between the previous row and the current row.\n\nBecause a cell without an `r` coordinate can still contain a value, the worksheet can avoid cell-coordinate row validation while still causing `GetRows()` to materialize rows up to the out-of-range row number.\n\n## Minimal worksheet payload\n\n```xml\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003cworksheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\"\u003e\n \u003csheetData\u003e\n \u003crow r=\"2000000\"\u003e\u003cc t=\"s\"\u003e\u003cv\u003e0\u003c/v\u003e\u003c/c\u003e\u003c/row\u003e\n \u003c/sheetData\u003e\n\u003c/worksheet\u003e\n```\n\nThe workbook also contains a normal `sharedStrings.xml` with one string (`ok`).\n\n## Reproduction\n\nA minimal Go harness creates the XLSX in memory and calls `GetRows(\"Sheet1\")`:\n\n```go\nrows, err := f.GetRows(\"Sheet1\")\nfmt.Println(\"rows_len:\", len(rows))\nif len(rows) \u003e 0 {\n fmt.Println(\"last_row:\", rows[len(rows)-1])\n}\nfmt.Printf(\"returned error: %T %v\\n\", err, err)\n```\n\nObserved output on current default branch commit `1213a8bd7c5ab360554603ac5c995ccaf6eb4314`:\n\n```text\n== streaming GetRows row r=2000000 cell without r ==\nrows_len: 2000000\nlast_row: [ok]\nreturned error: \u003cnil\u003e \u003cnil\u003e\nelapsed=21ms alloc_delta=46MB\n```\n\nObserved output on latest release tag `v2.10.1`:\n\n```text\n== streaming GetRows row r=2000000 cell without r ==\nrows_len: 2000000\nlast_row: [ok]\nreturned error: \u003cnil\u003e \u003cnil\u003e\nelapsed=14ms alloc_delta=46MB\n```\n\nA control using the checked parser with `row r=\"1048577\"` and `c r=\"A1048577\"` correctly returns `row number exceeds maximum limit`, confirming this report is about inconsistent enforcement in the streaming path rather than a missing global constant.\n\n## Expected behavior\n\n`Rows` / `GetRows` should reject row numbers greater than `TotalRows` with the same error behavior as the checked parser path.\n\n## Suggested remediation\n\n- Apply the same row-bound validation in the streaming reader immediately after parsing a row `r` attribute.\n- Preserve and return row parsing errors from `GetRows()` instead of silently continuing or returning only `Rows.Close()` errors.\n- Add regression tests for `GetRows()` on a worksheet containing `row r=\"1048577\"` with a cell value but no cell `r` coordinate.",
"id": "GHSA-q5j5-6p94-4gwc",
"modified": "2026-09-10T15:09:09Z",
"published": "2026-09-10T15:09:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/qax-os/excelize/security/advisories/GHSA-q5j5-6p94-4gwc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59161"
},
{
"type": "WEB",
"url": "https://github.com/qax-os/excelize/pull/2331"
},
{
"type": "WEB",
"url": "https://github.com/qax-os/excelize/commit/93f0b3caed37f21ef5079e3259c6c21dcfe68453"
},
{
"type": "PACKAGE",
"url": "https://github.com/qax-os/excelize"
},
{
"type": "WEB",
"url": "https://github.com/qax-os/excelize/releases/tag/v2.11.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…