Detections
Analytics

SCA: security update for excel-mcp-server (GHSA-j98m-w3xp-9f56)

critical Tenable Self-Hosted Container Security Plugin ID 440318

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - excel-mcp-server is a Model Context Protocol server for Excel file manipulation. A path traversal
 vulnerability exists in excel-mcp-server versions up to and including 0.1.7. When running in SSE or
 Streamable-HTTP transport mode (the documented way to use this server remotely), an unauthenticated
 attacker on the network can read, write, and overwrite arbitrary files on the host filesystem by supplying
 crafted filepath arguments to any of the 25 exposed MCP tool handlers. The server is intended to confine
 file operations to a directory set by the EXCEL_FILES_PATH environment variable. The function responsible
 for enforcing this boundary — get_excel_path() — fails to do so due to two independent flaws: it passes
 absolute paths through without any check, and it joins relative paths without resolving or validating the
 result. Combined with zero authentication on the default network-facing transport and a default bind
 address of 0.0.0.0 (all interfaces), this allows trivial remote exploitation. This vulnerability is fixed
 in 0.1.8. (CVE-2026-40576)

Solution

Update the excel-mcp-server library and its related packages to version 0.1.8 or later.

See Also

https://github.com/advisories/GHSA-j98m-w3xp-9f56

Plugin Details

Severity: Critical

ID: 440318

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 4/14/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7.3

Percentile: 98.43

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 9.7

Temporal Score: 7.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:C/A:C

CVSS Score Source: CVE-2026-40576

CVSS v3

Risk Factor: Critical

Base Score: 9.4

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/14/2026

Vulnerability Publication Date: 4/14/2026

Reference Information

CVE: CVE-2026-40576

cwe: CWE-22