Grist-core versions before 1.7.15 improperly neutralize user input during web page generation, leading to a reflected and stored cross-site scripting (CWE-79) vulnerability. User-controlled values such as document names, descriptions, and the OAuth2 openerOrigin parameter are embedded into pages and inline scripts without full escaping. This allows an attacker with document editor privileges to inject scripts that execute in the context of other users' authenticated sessions, enabling reading/modifying data and changing sharing/access settings, effectively escalating privileges to owner level. The issue is resolved in version 1.7.15.

Successful exploitation allows an attacker with document editor access to execute arbitrary scripts in the context of other users' sessions. This can lead to unauthorized data access or modification and privilege escalation to owner-level permissions within the affected Grist document. The vulnerability does not impact availability but compromises confidentiality and integrity.

Upgrade to grist-core version 1.7.15 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is documented. Patch status is confirmed by the vendor advisory stating the fix in 1.7.15.