Critical flaw in a popular Excel AI tool could let attackers read and write any file

A vulnerability tracked as CVE-2026-85661 has just landed with a near-maximum severity score of 9.8 out of 10, the kind of number that usually means “patch this today.” The bug lives in excel-mcp-server, a tool that lets AI agents create, read and edit Excel files without needing Microsoft Excel installed - and on GitHub it’s not a niche project, with over 4,200 stars and 461 forks.

The catch, as ever, is in the detail of who’s exposed.

What the bug actually does

According to the NVD entry, version 0.1.8 of excel-mcp-server fails to properly confine file paths when it’s run in “stdio mode” and a configuration variable called EXCEL_FILES_PATH is left unset. In plain terms: the server is supposed to keep its file operations boxed inside a designated folder, but if that folder isn’t explicitly configured, it doesn’t enforce any boundary at all. That opens the door for an attacker who can send commands to the server to read or write arbitrary files on the host system - not just spreadsheets, potentially anything the process has permission to touch.

excel-mcp-server is built on the Model Context Protocol (MCP), the increasingly common standard for letting AI agents call out to external tools. The project’s source code is public, so the specific handling of file paths can, in principle, be checked by anyone technical enough to follow it through - though NVD’s summary is the clearest confirmation of the flaw’s mechanics currently available.

So who is actually at risk

This is not a bug that affects ordinary Excel users, or anyone using Microsoft’s own software. It only matters to people who have deliberately installed and run excel-mcp-server themselves, typically developers or teams wiring AI agents up to spreadsheet tools, and specifically those running it in “stdio mode” without setting the EXCEL_FILES_PATH variable.

That’s a meaningfully narrower group than “everyone using Excel,” but it’s not nobody either - MCP servers like this one are increasingly bolted onto AI coding assistants and automation pipelines, often by developers moving fast and skipping configuration steps. A project with thousands of GitHub stars suggests real uptake, though stars and forks are a popularity signal, not a count of live, internet-facing installs - so how many actual deployments are sitting exposed right now is simply not known from what’s public.

Two other things worth flagging as unresolved: there is, at the time of writing, no confirmation of a patched release superseding 0.1.8, and no evidence in the public record of the flaw being actively exploited. Both would materially change the urgency here, and neither should be assumed either way.

What to do about it

If you or your organisation run excel-mcp-server, the sensible move is to explicitly set EXCEL_FILES_PATH to a locked-down directory rather than leaving it unset, and to check the project’s GitHub repository for any newer release or advisory addressing this CVE before continuing to run it, particularly in any setup reachable by untrusted input.

For everyone else - anyone simply using Excel, or an AI assistant that happens to touch spreadsheets through a properly configured, patched or non-affected setup - this isn’t something to lose sleep over. It’s a real and serious flaw for a specific slice of self-hosted AI tooling, not a mass-market Excel scare, and the sensible response is a configuration check, not a panic.