SpreadJS_mcp

The `src/tools/io.ts` module allows the AI (driven by user prompts) to read from and write to the local filesystem via tools like `import_json`, `export_json`, `import_csv`, and `export_csv` using a user-provided `filePath`. This poses a critical security risk, as a malicious prompt could instruct the AI to read sensitive server files (e.g., `/etc/passwd`) or write arbitrary files, potentially leading to remote code execution or data exfiltration. Additionally, the backend spawns the MCP server as a child process; while the default path is relative, if `SPREADJS_MCP_PATH` were to be controlled by an attacker, it could lead to arbitrary code execution. The application also handles arbitrary file uploads, which are then analyzed by the AI, increasing the potential attack surface if combined with the filesystem manipulation tools.