by Kastro
Paper/Archive/CVE-2026-85661

CVE-2026-85661

haris-musa excel-mcp-server — excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.7.527 × 2010.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process.

Affected

ProductAffectedFixed inSource
excel-mcp-server≤ 0.1.8–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/haris-musa/excel-mcp-server/issues/149refgithub.com/haris-musa/excel-mcp-serverwriteupgithub.com/haris-musa/excel-mcp-server/blob/v0.1.8/src/excel_mcp/server.pywriteupgithub.com/haris-musa/excel-mcp-server/blob/v0.1.8/src/excel_mcp/validation.pywriteupvulncheck.com/advisories/excel-mcp-server-0.1.8-arbitrary-file-read-write-via-stdio-mode