CRITICALVulnerability

CVE-2026-85661

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process.

Properties

severity
CRITICAL
score
9.8
cve_id
CVE-2026-85661
signal_observed_at
2026-09-16T13:31:01+00:00
vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
published_at
2026-09-04T15:17:43.643
last_modified
2026-09-14T20:16:59.127

Related Entities (2)

HAS_WEAKNESS (1)

[Weakness]Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

DESCRIBED_BY (1)

[Source]NVD

Explore deeper with Ninja Signal's threat intelligence graph

CVE-2026-85661 — Ninja Signal Threat Intelligence | Ninja Signal