Browser script execution via direct macro eval

Cross-site scripting in ONLYOFFICE allows remote attackers to execute JavaScript in an editor user's browser through a malicious document macro. The editor parses macro data from the document, concatenates the stored macro value into a function wrapper, and passes the result directly to eval(). A target must open a document containing attacker-controlled macro data; the script then runs in the embedding service's web origin and can read data or perform actions available to that session.