CVE-2026-88405

CVSS 9.8 (critical) · published 2026-09-21

A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload.

Weakness: CWE-94

Source: NVD CVE-2026-88405

References

• https://github.com/czx1111/cve/issues/9
• https://github.com/czx1111/cve/issues/9

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.