A vulnerability classified as critical was found in ishayoyo excel-mcp up to 1.0.2 . Impacted is an unknown function of the file src/index.ts of the component read_file/write_file . Executing a manipulation of the argument filePath/outputPath can lead to path traversal. This vulnerability is registered as CVE-2026-10278 . It is possible to launch the attack remotely. Furthermore, an exploit is available. The project was informed of the problem early through an issue report but has not responded