Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Univer can let remote attackers run any code

CVE-2026-88404 · published 28 days ago
Summary

The version 1.0.0-alpha.2 of Univer contains a flaw in its script execution service that lets a specially crafted request run any commands on the server. This could let attackers take control of the system or steal data. Update to a patched version or apply the vendor's recommended mitigation as soon as possible.

Original advisory text
A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrar...
A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published21 Sep 2026
Updated19 Oct 2026
First seen21 Sep 2026
Sources
CVE-2026-88404 · NVD
CVE-2026-88404 · MITRE
Track software like this
Free during beta