Product
The excel-mcp-server package version 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to perform arbitrary file reads and writes on the host system.