CVE-2026-88405

Low risk· EPSS 11%

Published: 21/09/2026(UTC)Translated: 22/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

Remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function in Univer v1.0.0-alpha.2. Attackers can execute arbitrary code via a crafted payload.

Risk Assessment

Risk of server compromise and breach of data confidentiality and integrity.

Recommendation

Apply available patches or update Univer to a fixed version. Restrict access to sensitive functions.

Other vulnerabilities in Univer

CVE-2026-88404Critical
Remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function in Univer v1.0.0-alpha.2. Attackers can execute arbitrary code via a crafted payload.

Original NVD description (English source)

A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload.