This vulnerability affects ishayoyo excel-mcp versions 1.0.0 through 1.0.2. It arises from improper validation of file path inputs in the component handling file read and write operations (src/index.ts). An attacker can manipulate the filePath or outputPath parameters to perform a path traversal attack, potentially accessing files outside the intended directories. The vulnerability is remotely exploitable without user interaction and requires low privileges. Although publicly disclosed, no official remediation or patch has been released by the vendor as of the publication date.

Successful exploitation allows an attacker to access or manipulate files outside the intended directory structure of the application. This can lead to unauthorized disclosure or modification of files on the system where excel-mcp is deployed. The vulnerability does not require user interaction and can be triggered remotely with low complexity. The overall impact is rated medium based on the CVSS 4.0 score of 5.3.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's communications for updates or patches. Until a fix is provided, avoid exposing the vulnerable component to untrusted networks or inputs. Implementing external controls such as input validation proxies or restricting file system permissions may reduce risk but are not guaranteed to fully mitigate the vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.