Vulnerabilities

Filters

1 selected

9 records

Sort

Vendor: gristlabs Clear all filters

TI-2026-40186 CVE-2026-55664

Grist: Insufficient access control in the /forms endpoint exposes table metadata

LOW 20

Grist is spreadsheet software using Python as its formula language.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00331 Published 2026-07-10 Fixed in 1.7.15 CWE-200

TI-2026-40187 CVE-2026-55665

DOM-based XSS in Grist via unsanitized links, enabling privilege escalation

LOW 37

Grist is spreadsheet software using Python as its formula language.

CVSS 4.0HIGH 8.5 Network No auth User interaction EPSS 0.00529 Published 2026-07-10 Fixed in 1.7.15 CWE-79

TI-2026-40182 CVE-2026-55659

Grist: XSS through unsafe value interpolation in server-rendered pages

LOW 34

Grist is spreadsheet software using Python as its formula language.

CVSS 3.1HIGH 7.7 Network Low privileges User interaction EPSS 0.00364 Published 2026-07-10 Fixed in 1.7.15 CWE-116

TI-2026-19341 CVE-2026-24002

pyodide sandbox option is insecure

MEDIUM 43

Grist is spreadsheet software using Python as its formula language.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.0052 Published 2026-01-22 Fixed in 1.7.9 CWE-74

TI-2025-40091 CVE-2025-64753

grist-core has insufficient access control in endpoints for comparisons between documents and versions

LOW 28

grist-core is a spreadsheet hosting server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00241 Published 2025-11-13 Fixed in 1.7.7 CWE-863

TI-2025-40090 CVE-2025-64752

grist-core has path to server-side requests via websocket

LOW 30

grist-core is a spreadsheet hosting server.

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.00243 Published 2025-11-13 Fixed in 1.7.7 CWE-918

TI-2024-37319 CVE-2024-56359

Cross-site Scripting vulnerability through HyperLink cells in grist-core

LOW 37

grist-core is a spreadsheet hosting server.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00316 Published 2024-12-20 Fixed in 1.3.2 CWE-79

TI-2024-37318 CVE-2024-56358

Cross-site Scripting vulnerability through svg attachment previews in grist-core

LOW 37

grist-core is a spreadsheet hosting server.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00297 Published 2024-12-20 Fixed in 1.3.2 CWE-79

TI-2024-37317 CVE-2024-56357

Cross-site Scripting vulnerability through custom widget URLs and form redirect URLs in grist-core

LOW 37

grist-core is a spreadsheet hosting server.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00314 Published 2024-12-20 Fixed in 1.3.1 CWE-79