What is the CVSS score of EUVD-2026-84201?

EUVD-2026-84201 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-84201?

Within 24 hours, inventory every deployment of Univer v1.0.0-alpha.2 and determine whether the remote function-registration service (/remote/remote-register-function.service.ts) is exposed beyond localhost or a trusted internal segment; where it is, remove it from any internet-facing or broadly reachable network path, block inbound access at the firewall or load balancer, and confirm with application owners whether the endpoint can be disabled entirely for the duration. Within 7 days, treat every confirmed instance as untrusted: isolate affected hosts in a restricted network segment, apply a web application firewall or reverse-proxy rule that rejects requests to the remote registration path, rotate any credentials, tokens, or secrets stored on or reachable from those hosts, and review logs for anomalous requests to that endpoint since deployment. Within 30 days, replace Univer v1.0.0-alpha.2 with a supported, non-alpha release or an alternative platform, or if the project must continue, keep the remote registration service permanently disabled or bound to loopback behind authenticated service mesh controls; establish a standing process to track the vendor advisory for a fixed version and validate that compensating controls remain enforced until a patch is available.

Univer EUVD-2026-84201

| CVE-2026-88405 CRITICAL

Code Injection (CWE-94)

2026-09-21 mitre

GHSA-c4rf-xpw9-chfc

RCE Code Injection

9.8

CVSS 3.1 · Vendor: mitre

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Locate exposed RemoteRegisterFunctionService endpoint
Delivery

Send crafted function-registration payload
Exploit

Trigger code injection in register handler (CWE-94)
Execution

Execute arbitrary code in server context
Impact

Full host compromise (C:H/I:H/A:H)

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires a reachable/enabled RemoteRegisterFunctionService remote endpoint (/remote/remote-register-function.service.ts) in Univer v1.0.0-alpha.2 specifically; the attacker sends a crafted payload to that function-registration service to trigger code injection. Limiting factors: only the pre-release alpha-2 build is named as affected (stable releases not confirmed vulnerable), and exploitation depends on the remote registration service actually being exposed to the attacker's network rather than disabled or internal-only. Per CVSS PR:N/UI:N, no authentication or user interaction is needed once the endpoint is reachable.
Impact	The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes a maximally severe network, unauthenticated, low-complexity RCE with full CIA impact - consistent with CWE-94 code injection in a 'remote' function-registration service. However, the supporting exploitation signals do NOT reinforce that critical rating: EPSS is only 0.21% (11th percentile), there is no CISA KEV listing, and no SSVC framework decision was supplied. The affected artifact is a single pre-release build (v1.0.0-alpha.2) of a developer-oriented framework, which sharply narrows the real-world attack surface versus a stable, widely-deployed release. Net assessment: this is a genuinely dangerous code-execution class flaw on paper, but the practical priority is moderate rather than urgent - low deployment footprint (alpha SDK), no evidence of active exploitation, and low predicted exploitation probability. The 9.8 should be read as worst-case theoretical severity, not as evidence of widespread real-world risk.
Exploit ScenarioDerived	An attacker reaches a network-exposed Univer instance that has the RemoteRegisterFunctionService endpoint enabled and sends a crafted payload to the remote function-registration handler, which injects and executes attacker-controlled code (CWE-94) in the server process. Given CVSS AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required if the service is reachable. The referenced GitHub issue (czx1111/cve/issues/9) is a researcher CVE-report repository that may contain reproduction/PoC details, but PoC availability is not independently confirmed.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 24, 2026

Remote code execution in Univer v1.0.0-alpha.2 allows unauthenticated network attackers to execute arbitrary code via a crafted payload sent to the RemoteRegisterFunctionService endpoint (/remote/remote-register-function.service.ts). The vulnerability is rated CVSS 9.8 (critical) and requires the remote function-registration service to be reachable; only this pre-release alpha build is named as affected. No public exploit code or confirmed active exploitation has been identified, and EPSS indicates a low likelihood of exploitation (0.21%).

RemediationAI

No vendor-released patch has been identified at time of analysis. Until a fix is available, restrict network access to the /remote/remote-register-function.service.ts endpoint so that only trusted clients can reach it, and disable the RemoteRegisterFunctionService entirely if it is not required-though disabling it may break remote function registration features. Additionally, implement input validation or a web application firewall (WAF) rule to block malicious payloads targeting this service, and monitor logs for suspicious requests to the endpoint. Consider upgrading to a later version if one becomes available, as only the alpha-2 build is named as affected. Refer to the vendor advisory (if published) and the CVE record (https://nvd.nist.gov/vuln/detail/CVE-2026-88405) for updates.

Affected VersionsENISA

n/a n/a

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Univer is a collaborative document and spreadsheet platform, and the vulnerability resides in its RemoteRegisterFunctionService, a TypeScript service located at /remote/remote-register-function.service.ts. This service likely accepts remote function registrations without proper validation, leading to CWE-94 code injection: an attacker can inject malicious code that is then executed by the server. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is network-based, low-complexity, and requires no authentication or user interaction. The CPE string is generic (n/a), but the affected version is explicitly Univer v1.0.0-alpha.2. The root cause is insufficient input sanitization or authentication in the function-registration mechanism.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.8 CRITICAL

Remote unauthenticated crafted-payload code injection in a network-facing register-function service yields PR:N/AV:N/AC:L and full host CIA impact (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 24, 2026 - 13:22 NVD

9.8 (CRITICAL)

CVE Published

Sep 21, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 21, 2026 - 00:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload.

Executive ViewAI

Why It Matters

A critical remote code execution flaw in Univer v1.0.0-alpha.2, an open-source collaborative document and spreadsheet framework, allows a crafted payload delivered to the remote function-registration service endpoint to run arbitrary code on any host where that service is network-reachable. Because the affected artifact is a pre-release alpha build, exposure is limited to teams that have deployed it in development, internal tooling, or experimental collaboration platforms - but where it is deployed, a single reachable service can become a full host compromise. Leadership should care because the flaw is rated CVSS 9.8 with no vendor patch identified, meaning risk cannot be closed by patching alone and must be managed through exposure reduction and monitoring.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: disable or unbind the remote function-registration service endpoint; restrict network reachability of /remote/remote-register-function.service.ts to localhost or a trusted segment via firewall, security group, or reverse-proxy deny rule; deploy WAF rules blocking external requests to that path; isolate hosts running Univer v1.0.0-alpha.2; rotate secrets and monitor endpoint access logs for anomalous payloads.

Threat Intelligence Overview

EPSS Score

0.2%

Top 89% exploitable

Prevalence

Low

developer-oriented OSS office/spreadsheet SDK, only pre-release alpha build affected

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

Poc

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.