excel-mcp-server vulnerabilities
CVEs whose affected-version data names the excel-mcp-server package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-85661Critical· 9.8excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files
excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any …
▾ Midnightharis-musa · excel-mcp-serverEPSS 0.69%via NVD
CVE-2026-40576Critical· 9.4excel-mcp-server has a Path Traversal issue
excel-mcp-server has a Path Traversal issue
▾ Midnightexcel-mcp-server · excel-mcp-serverEPSS 0.46%via OSV