Cpe:2.3:a:excel-Mcp-Server:excel-Mcp-Server:0.1.8:*:*:*:*:*:*:*

The excel-mcp-server package version 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to perform arbitrary file reads and writes on the host system.