CVE-2026-88404 in Univer
Summary
by MITRE • 09/21/2026
A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The identified vulnerability resides within the Univer application, specifically affecting version 1.0.0-alpha.2 in the component responsible for script execution services. The core of this security flaw is located in the UniscriptExecutionService.execute function, which is exposed via a specific service endpoint defined in the source file /services/script-execution.service.ts. This architectural placement indicates that the vulnerability impacts the backend or server-side processing logic rather than client-side browser sandboxing issues, suggesting that untrusted input reaches an execution engine with insufficient validation mechanisms. The presence of this function implies that the application is designed to interpret and run scripts provided by users or external systems, a feature common in collaborative office suites or document editors where macro support might be enabled for automation purposes.
The technical nature of this vulnerability constitutes a classic Remote Code Execution (RCE) flaw caused by improper neutralization of special elements used in an OS command or script interpreter. When the execute function processes input data from remote actors, it fails to adequately sanitize or validate the payload before passing it to the underlying execution environment. This lack of rigorous input validation allows attackers to inject malicious commands that are interpreted as legitimate executable code. By crafting a specific payload, an adversary can bypass any existing logical controls and force the application to run arbitrary system-level instructions. The severity of this issue is compounded by its remote exploitability, meaning no prior authentication or physical access is necessarily required if the service endpoint is accessible over the network.
From an operational perspective, the impact of successfully exploiting this vulnerability is severe and potentially catastrophic for organizational infrastructure. An attacker who achieves code execution on the server hosting Univer gains the ability to manipulate system files, exfiltrate sensitive data stored within the application's database or file storage systems, and pivot further into the internal network. This scenario aligns with the MITRE ATT&CK framework technique T1059, which covers Command and Scripting Interpreter abuse, specifically relating to how adversaries use built-in operating system utilities to execute malicious actions. Furthermore, this vulnerability maps directly to CWE-78, Improper Neutralization of Special Elements used in an OS Command (OS Command Injection), highlighting the failure to distinguish between data and code during processing. The ability to run arbitrary code effectively grants full control over the affected server instance, leading to a complete compromise of confidentiality, integrity, and availability for all services hosted on that machine.
Mitigation strategies must focus immediately on restricting access to vulnerable endpoints and updating software components. Organizations running Univer version 1.0.0-alpha.2 should prioritize upgrading to a patched release where the developers have implemented strict input validation and output encoding within the script execution service. Until an update is available, network-level controls such as Web Application Firewalls (WAF) can be configured to detect and block patterns associated with command injection payloads targeting this specific endpoint. Additionally, implementing principle of least privilege for the application process ensures that even if exploitation occurs, the attacker's ability to impact critical system resources is limited by restricting file permissions and network access rights assigned to the service account running Univer. Regular security audits focusing on dynamic code analysis can help identify similar flaws in other parts of the script execution pipeline before they are exploited in production environments.