CVE-2026-85661 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-85661 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-85661 is a critical file-read/file-write vulnerability in excel-mcp-server 0.1.8 (CVSS 9.8). In stdio mode, if EXCEL_FILES_PATH is unset, the server fails to enforce path confinement. That means an attacker can supply arbitrary file paths to read/write tools and access any file the process can reach. For solo developers and small teams, this can quickly turn into source code theft, secret exposure, config tampering, or destructive file writes.

No active exploitation is known yet and it is not in CISA KEV, but the impact is severe enough to treat as an emergency. If you run this service locally, in CI, or inside a shared container, assume the blast radius includes credentials, tokens, repo contents, and any mounted volumes.

Immediate Action

  • Stop or isolate the service now if you cannot confirm a fixed release. Disable stdio mode or remove the service from any environment that has access to sensitive files.
  • Set EXCEL_FILES_PATH immediately to a dedicated, empty, tightly scoped directory if you must keep the service online.
  • Upgrade to a patched version as soon as one is available. If no fixed release exists yet, roll back to a known-safe version or disable the module entirely. See vendor advisory: vendor advisory / release notes.
  • Restrict filesystem access using container mounts, AppArmor/SELinux, or a dedicated unprivileged user with no access to source trees, home directories, or secret stores.
  • Rotate secrets if the service had access to API keys, SSH keys, tokens, or environment files.
  • Audit recent file activity for unexpected reads/writes, especially outside the intended Excel directory.

Affected Versions

  • excel-mcp-server@0.1.8 vulnerable when running in stdio mode and EXCEL_FILES_PATH is unset.
  • excel-mcp-server@0.1.8 also vulnerable if the configured path is too broad or the service is allowed to access sensitive mounts.
  • Safe version: TODO_FIXED_VERSION and later, once the vendor ships a patch.
  • If no patch is available: treat 0.1.8 as unsafe and disable the feature or service until a fixed release is published.

Resolution Guide

JavaScript / npm

npm uninstall excel-mcp-server
npm install excel-mcp-server@TODO_FIXED_VERSION
# or, if you must stay on the current release temporarily:
export EXCEL_FILES_PATH=/srv/excel-safe

Yarn

yarn remove excel-mcp-server
yarn add excel-mcp-server@TODO_FIXED_VERSION

pnpm

pnpm remove excel-mcp-server
pnpm add excel-mcp-server@TODO_FIXED_VERSION

Python / pip

pip uninstall excel-mcp-server
pip install excel-mcp-server==TODO_FIXED_VERSION
# temporary hardening
export EXCEL_FILES_PATH=/srv/excel-safe

pipx

pipx uninstall excel-mcp-server
pipx install excel-mcp-server==TODO_FIXED_VERSION

Java / Maven

<dependency>
  <groupId>TODO_GROUP_ID</groupId>
  <artifactId>excel-mcp-server</artifactId>
  <version>TODO_FIXED_VERSION</version>
</dependency>

Java / Gradle

dependencies {
  implementation "TODO_GROUP_ID:excel-mcp-server:TODO_FIXED_VERSION"
}

Linux packages

# apt
sudo apt-get remove excel-mcp-server
sudo apt-get install excel-mcp-server=TODO_FIXED_VERSION

# yum/dnf
sudo yum remove excel-mcp-server
sudo yum install excel-mcp-server-TODO_FIXED_VERSION

Docker

# Prefer a fixed tag or digest once published
docker pull TODO_REGISTRY/excel-mcp-server:TODO_FIXED_VERSION

# Temporary containment: run with a read-only, narrow mount
docker run --rm \
  -e EXCEL_FILES_PATH=/data/excel-safe \
  -v /srv/excel-safe:/data/excel-safe:rw \
  --read-only \
  --cap-drop=ALL \
  TODO_REGISTRY/excel-mcp-server:TODO_FIXED_VERSION

Config hardening

# Set a narrow, dedicated directory
export EXCEL_FILES_PATH=/srv/excel-safe

# Do not point this at:
# - your repo
# - $HOME
# - /tmp
# - any secrets or config directory

Minimal code fix example

// Pseudocode: enforce path confinement before any read/write
import path from "node:path";
import fs from "node:fs";

const base = process.env.EXCEL_FILES_PATH;
if (!base) {
  throw new Error("EXCEL_FILES_PATH must be set");
}

function resolveSafe(userPath) {
  const resolved = path.resolve(base, userPath);
  const root = path.resolve(base) + path.sep;
  if (!resolved.startsWith(root)) {
    throw new Error("Path traversal blocked");
  }
  return resolved;
}

Detection & Verification

Check the installed version

npm ls excel-mcp-server
pip show excel-mcp-server
docker image ls | grep excel-mcp-server

Check whether the risky config is present

printenv | grep EXCEL_FILES_PATH
grep -R "EXCEL_FILES_PATH" . 2>/dev/null

Look for direct path handling in code

grep -R "path.resolve\|fs.readFile\|fs.writeFile" . 2>/dev/null

Verify the fix

# Confirm the service refuses paths outside the allowed directory
test -n "$EXCEL_FILES_PATH" && echo "EXCEL_FILES_PATH set"

# Attempt a blocked path and expect failure
# Example: use a parent directory or absolute path outside the base

Dependency auditors

npm audit
pip-audit
yarn audit
pnpm audit

Risk and Impact

This bug can expose or overwrite any file the process can access, not just Excel files. In a small-team setup, that often includes source code, environment files, API keys, SSH material, CI secrets, and mounted cloud credentials. If the service runs with write access, an attacker may also tamper with application logic, poison build artifacts, or plant persistence.

Because the flaw is reachable through normal tool input, the safest assumption is that a compromised client, prompt injection, or malicious automation can trigger it. Contain it first, then patch, then rotate secrets and review file access logs.

Keep reading