CVE-2026-88405: Univer RCE Vulnerability

CVE-2026-88405 Overview

CVE-2026-88405 is a remote code execution (RCE) vulnerability in Univer v1.0.0-alpha.2. The flaw resides in the RemoteRegisterFunctionService function located at /remote/remote-register-function.service.ts. Attackers can send a crafted payload to the vulnerable service and execute arbitrary code on the target system. The vulnerability is classified under [CWE-94] Improper Control of Generation of Code (Code Injection). No authentication or user interaction is required for exploitation, and the attack can be launched over the network.

Critical Impact
Unauthenticated attackers can execute arbitrary code remotely by sending a crafted payload to the RemoteRegisterFunctionService endpoint, leading to full compromise of the host application.

Affected Products

Univer v1.0.0-alpha.2
Component: /remote/remote-register-function.service.ts
Function: RemoteRegisterFunctionService

Discovery Timeline

2026-09-21 - CVE-2026-88405 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-88405

Vulnerability Analysis

The vulnerability exists in the RemoteRegisterFunctionService component of Univer. This service accepts remote function registration requests and processes attacker-supplied payloads without adequate validation. Because the function registration path treats untrusted input as executable code, an attacker can inject and execute arbitrary logic within the application context.

Successful exploitation grants attackers the same privileges as the Univer process. This enables data theft, service disruption, lateral movement, and installation of persistent implants. The vulnerability requires no privileges and no user interaction, and it is exploitable over the network.

Root Cause

The root cause is improper control of code generation ([CWE-94]). The RemoteRegisterFunctionService accepts function definitions or code fragments from remote clients and evaluates them without sanitization or sandboxing. This design allows attacker-controlled input to reach a code execution sink.

Attack Vector

Attackers deliver a crafted payload to the remote function registration endpoint exposed by Univer. The service parses the payload and executes attacker-controlled logic within the application runtime. Because the endpoint is reachable over the network without authentication, mass exploitation against exposed instances is feasible.

Refer to the GitHub Issue Discussion for additional technical context on the vulnerable code path.

Detection Methods for CVE-2026-88405

Indicators of Compromise

Unexpected HTTP requests to paths matching /remote/remote-register-function or related registration endpoints from untrusted sources.
Spawning of child processes by the Univer application process, such as shells or interpreters not part of normal operation.
Outbound network connections from the Univer host to unfamiliar IP addresses shortly after receiving registration requests.
New or unexpected function registrations in Univer runtime logs.

Detection Strategies

Inspect application logs for requests to the RemoteRegisterFunctionService endpoint containing serialized function bodies or unusual payload sizes.
Deploy behavioral endpoint monitoring to identify anomalous process execution originating from the Univer runtime.
Correlate web server access logs with process creation events to surface exploitation attempts against the registration service.

Monitoring Recommendations

Enable verbose logging on Univer service endpoints, particularly for remote function registration operations.
Forward application and host telemetry to a centralized SIEM or data lake for correlation with threat intelligence.
Alert on any successful invocation of RemoteRegisterFunctionService from external network zones.

How to Mitigate CVE-2026-88405

Immediate Actions Required

Restrict network access to Univer instances so that the remote function registration endpoint is not reachable from untrusted networks.
Place Univer behind an authenticated reverse proxy or VPN until a patched version is deployed.
Audit existing deployments for prior exploitation attempts by reviewing access logs against the indicators listed above.
Rotate credentials and secrets accessible to the Univer process if compromise is suspected.

Patch Information

No official vendor patch or fixed version has been listed in the NVD advisory at the time of publication. Monitor the GitHub Issue Discussion and the upstream Univer repository for a patched release. Upgrade to any post-v1.0.0-alpha.2 release that documents a fix for RemoteRegisterFunctionService.

Workarounds

Disable the RemoteRegisterFunctionService route at the application or reverse proxy layer if remote function registration is not required.
Enforce strict allowlists on inbound traffic to Univer endpoints, permitting only trusted management hosts.
Run Univer under a least-privilege service account and within a container or sandbox to constrain the blast radius of successful exploitation.
Deploy a web application firewall rule that blocks requests to /remote/remote-register-function from external sources.

bash

# Example NGINX configuration to block the vulnerable endpoint externally
location ~* ^/remote/remote-register-function {
    allow 10.0.0.0/8;      # trusted management network
    deny all;              # block all other sources
}