The Apache POI security issue related to MODE-1934 has been fixed in the trunk repository.
So I suppose it will be available in the next release – but who knows when that will happen. Indeed, if I look at their changelog history, it could take up to 9 months to have a new release!
What's the solution not to wait so long to have POI put back into ModeShape?
Should we ask POI maintainers for an intermediary 3.9.1 release of the poi-scratchpad artifact?