A critical remote code execution vulnerability in Univer v1.0.0-alpha.2 poses a severe risk of full system compromise by unauthenticated attackers.

The vulnerability exists within the UniscriptExecutionService.execute() function located in the /services/script-execution.service.ts file. This flaw allows an unauthenticated attacker to supply a crafted payload that triggers arbitrary code execution on the underlying host.

The potential for unauthenticated remote code execution presents a maximum business risk, as it allows attackers to gain full control over the affected server. Given the CVSS score of 9.8, this vulnerability could lead to total data exfiltration, unauthorized modification of sensitive information, and significant service disruption. Such an incident would likely result in severe operational downtime and potential regulatory or reputational damage.

Immediate Action: Since no official patch is currently available, immediately isolate the affected Univer instance from public network access.

Proactive Monitoring: Monitor server logs for unusual execution patterns or unauthorized requests directed at the script execution service endpoint.

Compensating Controls: Implement strict network ingress filtering or deploy a Web Application Firewall rule to block suspicious payloads targeting the script execution service.

Public Exploit Available: Unknown.

Given the critical nature of this remote code execution flaw and the availability of proof-of-concept evidence, organizations using Univer v1.0.0-alpha.2 must prioritize immediate mitigation. Because a patch is not yet confirmed, limiting exposure through network segmentation is the most effective way to prevent exploitation until an official update is released by the vendor.