Executive brief
Univer is a spreadsheet and document collaboration platform. A critical vulnerability in its script execution service allows attackers to execute arbitrary JavaScript code in the browser of any user, potentially stealing sensitive data, manipulating documents, or attacking other collaborators sharing the same workspace. The flaw stems from directly executing user-supplied code via JavaScript's Function constructor without validation or sandboxing.
Technical details
The UniscriptExecutionService.execute() function in script-execution.service.ts uses the new Function() constructor to dynamically execute arbitrary JavaScript code passed as a string, inserting it directly into the function body via template interpolation. An attacker can inject malicious code either via the local Uniscript editor panel or remotely through the collaboration protocol's uniscriptRunEvent message channel over WebSocket, which accepts and executes script payloads without validation. The resulting code execution occurs in the browser context with full access to the Univer API, DOM, cookies, and localStorage.
Affected products
- Univer Univer v1.0.0-alpha.2
Timeline
- 2026-09-07: disclosed
- 2026-09-21: advisory