Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Disclosed vulnerability

CVE-2026-85661: arbitrary file read/write in excel-mcp-server stdio mode (no path confinement)

AIR-2026-0221 AIR record · 2026-09-excel-mcp-server-path-confinement
Open in dashboard About
From the supporting source
excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files.cveawg.mitre.org
The record
Disclosed
2026-09-04
Vendor
haris-musa
Product
excel-mcp-server
Risk domain
Tool misuse › Supply chain vulnerabilities
System type
Generative model
Who acted
AI was the target — MCP server path flaw; no model decision
Attack surface
MCP server
Autonomy level
Assistant
Initial vector
Malicious tool arguments
Impact type
Arbitrary file read, Arbitrary file write
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI04 – Agentic Supply Chain Vulnerabilities
MITRE ATLAS
AML.T0040 – AI Supply Chain Compromise
NIST AI RMF
MAP 4.1
EU AI Act
Annex III §2
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool failure
Mitigation
Scan dependencies and container images for vulnerabilities; Use trusted sources.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
excel-mcp-server 0.1.8 in stdio mode when EXCEL_FILES_PATH is unset (the default for desktop MCP clients)
Capability abused
file_read_toolfile_write_tool
Defense & remediation
Recorded defense
realpath+commonpath confinement (only in SSE/http paths, not stdio)
Guardrail kinds
Unknown
Guardrail outcome
Silent
Taxonomy & references
OWASP ASI04 Agentic Supply Chain VulnerabilitiesOWASP ASI02 Tool Misuse and ExploitationCVE-2026-85661path_traversalmissing_confinementstdio_transportmcp_server
Curator notes
CVSS 9.3 (v4.0) / 9.8 (v3.1). Assigned by VulnCheck; reported by George Chen. Also a case-insensitive formula-denylist bypass. Reported to maintainer 2026-06-05 (GHSA-9h7m-8h6c-6jh7) with no response, then filed publicly. PoC/disclosure; no real victim.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-85661: arbitrary file read/write in excel-mcp-server stdio mode (no path confinement)". AIR, AIR-2026-0221. https://agentincident.vercel.app/i/AIR-2026-0221/ (accessed 2026-10-19).