CVE-2026-88405 Details

A remote code execution vulnerability has been identified in Univer version 1.0.0-alpha.2. The issue arises in the RemoteRegisterFunctionService, specifically within the remote-register-function.service.ts file. This vulnerability allows attackers to execute arbitrary code by sending a crafted payload through the function registration process. The vulnerability is accessible via the public Facade API, which transmits user-defined functions that are then deserialized and executed in a remote process, such as a Web Worker or a Node.js child process.

To address this vulnerability, it is recommended to replace new Function() with a safe serialization mechanism that does not execute arbitrary code. Implement an allowlist-based validation for registered functions, use a sandboxed execution environment in Node.js scenarios, add integrity checks for functions transmitted via RPC, and consider using the structured clone algorithm instead of toString() serialization for function transfer.