excel-mcp-server npm Package Vulnerability: What We Know
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- excel-mcp-server (npm)
- Affected versions
- >= v0.1.8, <= v0.1.8 or >= v0.1.7, <= v0.1.7 or >= v0.1.6, <= v0.1.6 or >= v0.1.5, <= v0.1.5 or >= v0.1.4, <= v0.1.4 or >= v0.1.3, <= v0.1.3 or >= v0.1.2, <= v0.1.2 or >= v0.1.1, <= v0.1.1
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the excel-mcp-server npm package. Versions 0.1.1 to 0.1.8 are reportedly affected.
What happened
The excel-mcp-server npm package version 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset. This vulnerability allows attackers to read and write arbitrary files. The issue is under investigation and has a CVSS score of 9.8. The affected versions range from 0.1.1 to 0.1.8.
This vulnerability was first flagged on 2026-09-04T15:17:43.643000+00:00. It is not yet confirmed to be exploited in the wild nor part of a supply-chain attack. The primary source indicates that this is a critical issue requiring immediate attention.
What to do about it
- Await a patch for excel-mcp-server.
- Ensure EXCEL_FILES_PATH is set to mitigate the risk.
- Monitor the primary sources for updates on a patch release.
- Consider downgrading to a version prior to 0.1.1 if a patch is not available.
- Review your application's use of excel-mcp-server and implement additional security measures if necessary.
How 0Day would have caught this
excel-mcp-server is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using excel-mcp-server npm package versions 0.1.1 to 0.1.8.
What should I do right now?
Await a patch for excel-mcp-server and ensure EXCEL_FILES_PATH is set. Monitor the primary sources for updates.
Is there an official fix available?
No official fix has been published yet. Monitor the sources for updates.
How severe is this vulnerability?
This vulnerability has a CVSS score of 9.8, indicating a critical severity level.