Disclosure summary
### Summary A worksheet containing `` makes `mergeCellsParser` leave the cached rectangle empty, and `cellInRange` then indexes that empty slice without a length check. Every non-streaming cell API panics with `index out of range [0] with length 0` on the first cell read after opening the file. ### Where it is `cell.go`, `cellInRange` func cellInRange(cell, ref []int) bool { return cell[0] >= ref[0] && cell[0] = ref[1] && cell[1]
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
GitHub Reviewed Security Advisories · GHSA-g27h-8qhm-6pff
Open original source · Updated Oct 07, 2026
Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref
Source severity: MEDIUM / 0
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| go | github.com/xuri/excelize/v2 | >= 2.7.1, < 2.11.1-0.20260820023833-99903a3240e5 | 2.11.1-0.20260820023833-99903a3240e5 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Reviewed advisory
PUBLISHED 2026-10-07T16:23:17-04:00
MODIFIED 2026-10-07T16:23:18-04:00
INGESTED 2026-10-08T12:30:38-04:00