Excelize vulnerabilities

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. File.GetStyle relies on extractStyleCondFuncs predicates that allow negative FillID, BorderID, and FontID values to reach slice indexing. When a crafted styles.xml supplies a negative fillId, borderId, or fontId and the application reads the style, a negative identifier passes the upper-bound-only predicate and becomes a negative slice index, allowing an attacker to panic while reading cell styling. No fixed version is available as of this review.

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 through FileInfo.Size and passes the wrapped negative value to readFile. When a crafted Zip64 entry declares an uncompressed size from 2^63 through 2^64-1 and the workbook is opened, the negative size bypasses unzip limits and reaches make as a negative capacity, allowing an attacker to panic during workbook opening. No fixed version is available as of this review.

Vulnerability in Excelize (Go) from 2.1.0 to 2.11.0. flatCols expands column ranges without validating Min and Max against worksheet limits, allowing an attacker to cause excessive CPU/memory usage or OOM.

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormats reaches extractCondFmtCellIs and also indexes ColorScale.Cfvo, DataBar.Cfvo, and DataBar.Color without complete structural checks. When a crafted worksheet supplies a cellIs, dataBar, or colorScale rule missing expected children and the application calls GetConditionalFormats, missing formula, color, value-object, or colorScale data reaches an out-of-range index or nil dereference, allowing an attacker to panic and terminate an unprotected process. No fixed version is available as of this review.

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice from the last cell in XML document order and then re-scatters every cell by its explicit column reference. GetCellValue reaches workSheetReader and checkRow, where targetList is too short for an earlier out-of-order cell. When a crafted row places a higher-column cell before a lower-column final cell and a non-streaming worksheet API reads the sheet, the earlier cell's column index exceeds the slice length derived from the final cell, allowing an attacker to cause an unrecovered panic and terminate the process. No fixed version is available as of this review.

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser, which passes an empty rectangle derived from the mergeCell ref attribute into cellInRange. When a crafted worksheet contains an empty mergeCell ref and a non-streaming cell API reads the worksheet, cellInRange indexes four positions in an empty slice, allowing an attacker to panic on the first affected cell operation. No fixed version is available as of this review.

Vulnerability in Excelize (Go) from 2.3.1 to 2.11.0. Agile decryption accepts attacker-controlled spinCount and performs unbounded key derivation iterations, allowing CPU exhaustion.

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. RIGHT reaches leftRight through CalcCellValue, where countUTF16String validates one unit but utf8.RuneCountInString supplies the slice index in another. When RIGHT evaluates supplementary-plane text with a requested character count between the rune count and UTF-16 code-unit count, the inconsistent units produce a negative rune-slice index, allowing an attacker to panic during formula evaluation. No fixed version is available as of this review.

Vulnerability in Excelize (Go) from 2.0.0 to 2.11.0 (and 1.1.0-1.4.1). ColumnNameToNumber does not detect overflow, allowing a crafted column name to cause a panic and process termination.

Vulnerability in Excelize (Go) from 2.8.1 to 2.11.0. ANCHORARRAY recursively calls CalcCellValue, creating new calculation contexts and bypassing cycle controls, potentially causing a fatal Go stack overflow and process abort.

Excelize versions 2.3.1 to 2.11.0 trust the CFB directory entry stream size before validating it. A crafted OLE file can declare a negative or extremely large EncryptionInfo or EncryptedPackage stream size, causing a panic or memory exhaustion.

Excelize versions 2.3.1 to 2.11.0 perform insufficient structural and parameter validation before using attacker-controlled values in slicing, indexing, allocation, and division. A malformed OLE file can trigger unrecovered Go runtime panics, terminating the process.

Excelize versions 2.9.0 to 2.11.0 in GetSlicers checks for ExtLst but dereferences ws.Drawing without checking if the optional drawing element exists. A crafted worksheet with extLst but no drawing causes a nil pointer dereference and panic.

Excelize versions 2.1.0 to 2.11.0 in Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. A crafted worksheet with an oversized row number causes iteration through all missing rows, consuming CPU.

Excelize versions 2.8.1 to 2.11.0 use separately parsed pivot-table field indices to index the pivot-cache field-name slice without bounds checks. A crafted workbook with a field count mismatch or out-of-range value causes a slice-bounds panic.

The Excelize Go library before version 2.11.0 has a vulnerability due to missing lower-bound validation when parsing shared-string cell values. A specially crafted XLSX file with a value of -1 can cause an out-of-bounds slice access and panic when read via GetCellValue or GetRows.

The Excelize Go library before version 2.11.0 does not enforce the TotalRows limit on the row r attribute during streaming worksheet reading. An attacker can supply a small XLSX file with a row number above 1048576, causing empty rows to be appended and excessive memory and CPU consumption.

The Excelize Go library before version 2.11.0 has a vulnerability in the checkSheet() function that uses an attacker-controlled XML attribute <row r="N"> without validation. A crafted XLSX file can cause massive memory allocation (up to 16 GB) or a panic due to out-of-bounds indexing, leading to denial of service (DoS).