Read the docs
TI-2026-40182 Aliases CVE-2026-55659

Grist: XSS through unsafe value interpolation in server-rendered pages

Priority LOW 34CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-rendered Grist pages embedded user-controlled values into the page and into inline scripts without fully escaping them, allowing cross-site scripting. On the main application page, a document's name or description, set by a document editor, is rendered into the page that other users load when opening the document. On the OAuth2 end-of-flow page, the openerOrigin request parameter was reflected back into the served page. Injected script runs in the victim's Grist origin and can act through the authenticated session, reading or modifying data and changing sharing settings and access rules. A document editor could therefore escalate to owner-level access. This issue is fixed in version 1.7.15.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00364 30th percentileScored 2026-11-07
Fix Fixed grist-core (gristlabs): 1.7.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gristlabsgrist-corebefore 1.7.151.7.15Patch availableCNA
  • grist-core Vendorgristlabs Affected before 1.7.15 Fixed in 1.7.15 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:getgrist:grist-core:*:*:*:*:*:*:*:*——gristlabs
  • cpe:2.3:a:getgrist:grist-core:*:*:*:*:*:*:*:* Versions — — ·gristlabs

Remediation

  • Fix · CNA grist-core (gristlabs) Fixed in 1.7.15

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55659

References

Other 3

  • TI-2026-19341 pyodide sandbox option is insecure CVSS 3.1CRITICAL 9.6
  • TI-2026-40187 DOM-based XSS in Grist via unsanitized links, enabling privilege escalation CVSS 4.0HIGH 8.5
  • TI-2024-37319 Cross-site Scripting vulnerability through HyperLink cells in grist-core CVSS 3.1HIGH 8.1
  • TI-2024-37318 Cross-site Scripting vulnerability through svg attachment previews in grist-core CVSS 3.1HIGH 8.1
  • TI-2024-37317 Cross-site Scripting vulnerability through custom widget URLs and form redirect URLs in grist-core CVSS 3.1HIGH 8.1
  • TI-2025-40090 grist-core has path to server-side requests via websocket CVSS 3.1MEDIUM 6.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences