Executive brief
ishayoyo excel-mcp is a Model Context Protocol (MCP) server that allows AI agents like Claude to read and write Excel and CSV files. A security vulnerability in this tool allows an attacker to read or write files anywhere on the host system's storage, rather than being restricted to a specific folder. This could lead to the exposure of sensitive spreadsheets or the unauthorized modification of system files, potentially compromising the integrity of the host machine.
Technical details
A path traversal vulnerability (CWE-22/CWE-73) exists in ishayoyo excel-mcp through version 1.0.2. The vulnerability is located in the read_file and write_file components within src/index.ts, where user-supplied arguments such as filePath and outputPath are passed directly to filesystem APIs (fs.readFile, fs.writeFile, and exceljs methods) without proper sanitization or validation against a base directory. A remote attacker capable of invoking these MCP tools can provide absolute paths or traversal sequences to access or overwrite any file readable or writable by the server process. While the project was notified via a GitHub issue, no official patch has been released as of the advisory date.
Affected products
- ishayoyo excel-mcp up to 1.0.2
Timeline
- 2026-04-20: other: Vulnerability discovered by researcher
- 2026-05-11: disclosed: Public issue report opened on GitHub repository
- 2026-06-01: advisory: CVE published and listed in NVD