Enabling JavaScript should make Excel more powerful, but increasing access points makes it even more of a web security nightmare than it already is.

In the well-established Office Ready-Fire-Aim tradition, Microsoft adds two new “features” that beg to be abused. Details appeared at Build, and the bad guys already have their keyboards primed.

Right now, JavaScript in Excel custom functions is only supported in the Developer Preview edition to Office 365 subscribers enrolled in the Office Insiders program. But it seems inevitable that in ...