Excelize is a Go library that processes XLSX files. Before version 2.11.0 it converts the shared‑string identifier to an integer and checks only that it is less than the length of the shared‑string slice, ignoring negative values. If an attacker supplies a malformed XLSX file containing a shared‑string cell with the index –1, the library will attempt to access sharedStrings[-1] and panic, causing the host application to crash. The failure manifests as a denial‑of‑service condition for any service that uses GetCellValue or GetRows to read untrusted workbooks.

Any Go application that embeds qax‑os Excelize before version 2.11.0 and reads or processes XLSX files is vulnerable. This includes command‑line utilities, web services, or backend processing pipelines that use GetCellValue or GetRows on workbook data from untrusted sources.

With a CVSS of 6.9 the vulnerability is considered medium severity. The EPSS score is less than 1 %, indicating a very low likelihood of exploitation, and it is not listed in CISA’s KEV catalog. The attack vector requires delivery of a crafted file. Once the file is passed to GetCellValue or GetRows, the panicking library immediately terminates the application, resulting in an outage.