Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Univer 1.0.0-alpha.2 can run attacker code remotely

CVE-2026-88405 · published 28 days ago
Summary

The RemoteRegisterFunctionService component in Univer version 1.0.0-alpha.2 can be tricked into running any code an attacker sends. This could let an attacker take control of the system or steal data. Update to a newer, patched version of Univer as soon as possible.

Original advisory text
A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrar...
A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published21 Sep 2026
Updated19 Oct 2026
First seen21 Sep 2026
Sources
CVE-2026-88405 · NVD
CVE-2026-88405 · MITRE
Track software like this
Free during beta