Description

A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-21T21:17:14.507Z",
  "pubdate": "2026-09-21T21:17:14.507Z",
  "executiveSummary": "A critical remote code execution (RCE) vulnerability exists in Univer v1.0.0-alpha.2 within the UniscriptExecutionService.execute() function. The vulnerability arises from improper validation and sanitization of inputs processed by the script execution engine, allowing an unauthenticated or remote attacker to inject and execute arbitrary code on the underlying host system.\nThis flaw presents a severe security risk, as successful exploitation results in full system compromise, enabling the attacker to bypass access controls, exfiltrate sensitive data, install persistent backdoors, or pivot deeper into the internal network infrastructure.\nThe vulnerability is localized to the server-side script execution logic, specifically within the specified service file. The attack complexity is low, as it relies on the submission of a maliciously crafted payload to the vulnerable endpoint. There are no indications that specialized privileges are required to initiate the attack, provided the endpoint is network-accessible. Organizations utilizing this specific version of Univer are at immediate risk of remote exploitation and should prioritize defensive measures to restrict access to the service until a secure update is available.",
  "technicalDetails": "The vulnerability resides in the /services/script-execution.service.ts file of Univer v1.0.0-alpha.2, specifically within the UniscriptExecutionService.execute() function. The root cause of this RCE is the failure to effectively sandbox or validate user-supplied scripts before they are passed to the underlying execution engine. In modern web architectures, such services often interface with high-level languages or runtime environments that may inadvertently permit access to system-level APIs if not strictly constrained.\nThe attack flow commences when an attacker submits a crafted payload, likely formatted as a script or object serialized for the UniscriptExecutionService, to the application’s API endpoint responsible for triggering script execution. Because the .execute() function lacks robust input filtration, the attacker can supply malicious code structures that deviate from the expected execution schema. If the application environment runs with elevated system permissions, the executed code inherits these privileges, effectively bypassing the intended application-level isolation.\nUpon reaching the server, the unsanitized input is parsed by the UniscriptExecutionService, which initiates the execution process. By leveraging language-specific features or reflection capabilities accessible within the script runtime, the attacker can invoke system-level commands, shell processes, or file system operations. For instance, if the execution context permits access to global objects or modules that interface with the host operating system (e.g., node.js child_process or filesystem modules), the attacker can execute arbitrary binary commands.\nThe impact of this vulnerability is total system integrity loss. Once the initial code execution is achieved, an attacker can perform post-exploitation activities including environment reconnaissance, lateral movement within the server's network segment, or the deployment of web shells for persistent unauthorized access. Since this is a server-side execution flaw, the exposure is limited only by the network visibility of the service hosting Univer. Because there is no mention of authentication requirements in the initial service call, the vulnerability likely exposes the application to remote attackers without the need for prior authorization, significantly increasing the probability of successful exploitation in internet-facing deployments."
}