CVE-2026-88404

CVSS 9.8 (critical) · published 2026-09-21

A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload.

Weakness: CWE-94

Source: NVD CVE-2026-88404

References

• https://github.com/czx1111/cve/issues/8
• https://github.com/czx1111/cve/issues/8

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.