CVE-2026-88404 Overview
CVE-2026-88404 is a remote code execution (RCE) vulnerability in Univer v1.0.0-alpha.2. The flaw resides in the UniscriptExecutionService.execute() function located in /services/script-execution.service.ts. Attackers can send a crafted payload to execute arbitrary code on the target system. The weakness is classified under [CWE-94] Improper Control of Generation of Code (Code Injection).
The vulnerability is exploitable over the network without authentication or user interaction. Successful exploitation grants attackers full control over the affected application context, compromising confidentiality, integrity, and availability.
Critical Impact
Unauthenticated attackers can execute arbitrary code remotely by submitting a crafted payload to the vulnerable script execution service, leading to complete system compromise.
Affected Products
- Univer v1.0.0-alpha.2
- UniscriptExecutionService.execute() function
- /services/script-execution.service.ts component
Discovery Timeline
- 2026-09-21 - CVE-2026-88404 published to NVD
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-88404
Vulnerability Analysis
The vulnerability exists within the UniscriptExecutionService.execute() function in Univer's script execution service. The function processes user-supplied input and passes it to a code execution routine without adequate validation or sandboxing. Attackers who reach this endpoint can craft payloads that the service interprets and executes as code.
Because the flaw permits arbitrary code execution in the application process, adversaries can pivot to file system access, credential theft, and lateral movement. The affected version, v1.0.0-alpha.2, is a pre-release build, which increases the likelihood that development or staging environments are exposed.
Root Cause
The root cause is improper control of generation of code [CWE-94]. The execute() method processes attacker-controllable script content without safe parsing, allow-listing, or isolation. Any input reaching this handler is treated as executable code within the service context.
Attack Vector
Exploitation occurs over the network. An attacker submits a crafted payload to the endpoint that invokes UniscriptExecutionService.execute(). No authentication, privileges, or user interaction are required. The malicious script runs in the same process as the Univer service, giving the attacker the permissions of that service account.
Detailed technical context is documented in the public GitHub issue for CVE-2026-88404.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-88404
Indicators of Compromise
- Unexpected HTTP requests targeting Univer script execution endpoints containing scripting keywords such as require, process, child_process, or eval.
- Univer service processes spawning unusual child processes such as shells, curl, wget, or scripting interpreters.
- Outbound network connections initiated by the Univer service to unknown or untrusted hosts.
- New or modified files in Univer working directories with no corresponding deployment activity.
Detection Strategies
- Inspect application logs for calls to UniscriptExecutionService.execute() with anomalously large or obfuscated payloads.
- Deploy web application firewall (WAF) rules that flag script-injection patterns targeting the script execution route.
- Baseline normal Univer process behavior and alert on deviations, including new child processes or unexpected network egress.
Monitoring Recommendations
- Enable verbose logging on the Univer service and forward events to a centralized SIEM for correlation.
- Monitor process ancestry for the Univer runtime to detect execution of interpreters or system utilities.
- Track egress traffic from application servers hosting Univer and alert on connections to non-approved destinations.
How to Mitigate CVE-2026-88404
Immediate Actions Required
- Restrict network exposure of the Univer service by placing it behind authenticated reverse proxies and network access control lists.
- Remove or disable the UniscriptExecutionService.execute() endpoint in production deployments until a patched version is available.
- Audit deployments running Univer v1.0.0-alpha.2 and remove pre-release builds from internet-facing environments.
- Rotate credentials and API keys accessible to the Univer service process in case of prior exposure.
Patch Information
No vendor patch is referenced in the CVE record at the time of publication. Monitor the Univer project issue tracker and upstream Univer releases for a fixed version. Upgrade away from v1.0.0-alpha.2 as soon as a hardened release is published.
Workarounds
- Disable the script execution feature entirely if it is not required for business operations.
- Enforce strict input validation and allow-listing on any request path that reaches UniscriptExecutionService.execute().
- Run the Univer service under a low-privilege account with restricted file system and network permissions to limit the blast radius of successful exploitation.
- Apply egress filtering to block outbound connections from the Univer host to untrusted destinations.
# Example: restrict the Univer service to loopback until patched
# Bind the service to localhost and front it with an authenticated proxy
export UNIVER_BIND_ADDRESS=127.0.0.1
export UNIVER_SCRIPT_EXECUTION_ENABLED=false
systemctl restart univer
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
