Summary
Univer v1.0.0-alpha.2 contains a critical remote code execution vulnerability in the RemoteRegisterFunctionService function. An attacker may execute arbitrary code by sending a crafted payload to an exposed service endpoint, if the affected remote registration functionality is reachable.
Affected context
The vulnerability occurs in Univer's /remote/remote-register-function.service.ts component when the remote function registration service processes attacker-controlled input. Risk is higher when the service is network-accessible and accepts registration requests without sufficiently restricting or safely handling executable content.
Exploit preconditions
- Attack surface: The remote function registration service endpoint - Required access: Network reachability and any access permitted by the
deployment's authentication and authorization controls
- Trigger point: Processing a crafted request by
RemoteRegisterFunctionService
- Why exploitation is possible: Attacker-controlled data can reach a code
execution path without adequate separation between input data and
executable logic
Why this happens
The underlying flaw is a failure to treat externally supplied function registration data as untrusted input. When input is incorporated into a dynamic execution path, interpreted as code, or passed to an unsafe evaluation mechanism, an attacker may influence the runtime behavior of the service. This behavior maps to CWE-94, Improper Control of Generation of Code, because application-controlled code generation or execution is not sufficiently constrained.
Potential impact
- An attacker may execute arbitrary code in the Univer service process.
- The vulnerability could expose application data and configuration secrets.
- A compromised service may be used to access connected systems or resources.
- Attackers may alter application behavior, disrupt availability, or establish persistence.
General mitigation guidance
Mitigation generally focuses on removing dynamic code execution from remote registration workflows and treating registration content as data rather than executable logic. Secure-by-default designs can use a fixed allowlist of server-side functions, structured identifiers, and constrained schemas instead of accepting arbitrary code. Input trust should be reduced through strict validation, canonicalization, authorization, and limits on registration content. Remote services should require narrowly scoped privileges, isolate execution where dynamic behavior is unavoidable, and avoid exposing sensitive credentials to the service process.
How teams detect issues like this
Detection approaches include static analysis for dynamic evaluation, runtime compilation, string-to-code conversion, and unsafe interpretation of request data. Code reviews should examine remote registration handlers, function lookup logic, authorization checks, and any path where request fields influence executable behavior. Monitoring can enforce policies that restrict registration endpoints, flag unexpected function definitions or execution-related errors, and record authenticated administrative changes. Automated security review tools may help identify code-generation patterns during development.
