excel-mcp-server vulnerabilities

2 known vulnerabilities in excel-mcp-server from Haris-musa. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  excel-mcp-server: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-85661Sep 4, 2026Haris-musa

  excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the

• 9.4 Critical severity

  excel-mcp-server: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-40576Apr 21, 2026Haris-musa

  excel-mcp-server is a Model Context Protocol server for Excel file manipulation. A path traversal vulnerability exists in excel-mcp-server versions up to and including 0.1.7. When running in SSE or Streamable-HTTP transport mode (the documented way to use this