OnlyShells: from XSS to SYSTEM in ONLYOFFICE

BI․ZONE researchers discovered a vulnerability chain in ONLYOFFICE Desktop Editors dubbed OnlyShells. To trigger it, the victim only needs to open a specially crafted document — enabling macros or performing any additional actions is not required.

The OnlyShells chain consists of the following stages:

1 Cross-site scripting Three XSS vulnerabilities allowed JavaScript to be injected into document elements processed by the editor: CVE-2025-68917 — the comment editing field; CVE-2025-68935 — the font name in the multilevel list settings; CVE-2025-68936 — the color theme name.

2 Remote code execution ONLYOFFICE Desktop uses the Chromium Embedded Framework, which includes the JavaScript V8 engine with the vulnerability tracked as CVE-2023-2033. A compilation bug allows an attacker to obtain the ​hole value — the internal representation of an empty slot in JavaScript arrays. Using type confusion and memory corruption, the researchers turned the JavaScript injection into remote code execution.

3 Privilege escalation After obtaining local code execution, the researchers discovered that the ONLYOFFICE update service allowed file operations to be performed as NT AUTHORITY\SYSTEM, completing the chain and leading to full Windows compromise (CVE-2026-4103).

Together, these vulnerabilities formed a one-click RCE chain with maximum privileges.

The recommended mitigation is to update ONLYOFFICE Desktop Editors to version 9.3.0.

Article: https://bi.zone/eng/expertise/blog/lomaem-onlyoffice-za-3-shaga-tsepochka-uyazvimostey-onlyshells/