CVE-2026-85661 [CRITICAL] – excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PA

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process.