Summary
A critical code-injection vulnerability in Univer's UniscriptExecutionService.execute() function may allow an attacker to execute arbitrary code by submitting a specially crafted payload.
The issue becomes risky when attacker-controlled input reaches the script-execution path without effective isolation, validation, or restrictions on executable behavior.
Affected context
The vulnerability occurs in Univer v1.0.0-alpha.2 within /services/script-execution.service.ts, specifically the UniscriptExecutionService.execute() function. Deployments are exposed when this service accepts attacker-influenced payloads and processes them in a context where the resulting code can execute with the service's runtime privileges.
Exploit preconditions
- Attack surface: The UniscriptExecutionService execution interface
- Required access: Ability to submit or otherwise influence a payload accepted by the execution function; authentication requirements are deployment-dependent
- Trigger point: Processing of a crafted payload by
UniscriptExecutionService.execute() - Why exploitation is possible: Attacker-controlled data reaches an execution path in a form that permits arbitrary code behavior rather than being limited to a constrained, non-executable data model
Why this happens
The underlying bug is a code-injection condition in which externally controlled input is processed by a script-execution function without sufficient separation between data and executable logic. This behavior maps to CWE-94: Improper Control of Generation of Code ('Code Injection'), because crafted input can influence code that the service executes.
Potential impact
- An attacker may execute arbitrary code in the Univer service process
- The attacker could access or modify data available to that process
- Service credentials, secrets, or connected resources may be exposed
- The application could be disrupted or used for lateral movement
- Integrity of dependent systems or generated content may be compromised
General mitigation guidance
Mitigation generally focuses on removing implicit code execution from request processing and reducing trust in externally supplied input.
Common defensive patterns include:
- Replacing general-purpose script execution with a narrowly defined, non-executable operation model
- Applying strict allowlists, schemas, and type validation before processing payloads
- Separating data parsing from execution and rejecting unexpected fields or constructs
- Isolating any unavoidable execution in a hardened, short-lived sandbox with minimal privileges
- Limiting service credentials, filesystem access, network reachability, and available runtime capabilities
- Enforcing authentication, authorization, request limits, and secure-by-default execution policies
- Avoiding storage or propagation of untrusted payloads across trusted execution boundaries
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying dynamic evaluation, command execution, template compilation, or interpreter APIs that receive request-derived data
- Code review checks tracing payload fields from service boundaries into execution-capable functions
- Tests that submit unexpected types, delimiters, and executable-looking content and verify rejection
- Runtime monitoring for anomalous child processes, command execution, filesystem access, or outbound connections from the service
- Policy enforcement that blocks unrestricted script execution in application-facing services
- Automated security review tools configured to flag CWE-94 patterns and untrusted-data flows
