Is CVE-2026-85661 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-85661?

CVE-2026-85661 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-85661

Description

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process.