CVE-2026-55659: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in gristlabs grist-core
Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-rendered Grist pages embedded user-controlled values into the page and into inline scripts without fully escaping them, allowing cross-site scripting. On the main application page, a document's name or description, set by a document editor, is rendered into the page that other users load when opening the document. On the OAuth2 end-of-flow page, the openerOrigin request parameter was reflected back into the served page. Injected script runs in the victim's Grist origin and can act through the authenticated session, reading or modifying data and changing sharing settings and access rules. A document editor could therefore escalate to owner-level access. This issue is fixed in version 1.7.15.
AI Analysis
Technical Summary
CVE-2026-55659 is a cross-site scripting vulnerability in gristlabs grist-core spreadsheet software versions before 1.7.15. The vulnerability arises because several server-rendered pages embed user-controlled values into HTML and inline scripts without adequate escaping. Specifically, document names or descriptions set by document editors and the OAuth2 end-of-flow openerOrigin parameter are reflected unsafely. An attacker can inject malicious scripts that execute within the victim's Grist origin, leveraging the authenticated session to read or modify data and alter sharing settings, effectively escalating privileges from editor to owner. The vulnerability has a CVSS 3.1 score of 7.7 (high severity) and is fixed in version 1.7.15.
Potential Impact
Exploitation of this vulnerability allows an attacker with document editor privileges to execute arbitrary scripts in the context of other users' sessions. This can lead to unauthorized reading or modification of data, and changes to sharing settings and access controls, resulting in privilege escalation to owner-level access. There are no known exploits in the wild as of the published date.
Mitigation Recommendations
Upgrade grist-core to version 1.7.15 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is documented. Patch status is confirmed fixed in 1.7.15.
CVE-2026-55659: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in gristlabs grist-core
Description
Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-rendered Grist pages embedded user-controlled values into the page and into inline scripts without fully escaping them, allowing cross-site scripting. On the main application page, a document's name or description, set by a document editor, is rendered into the page that other users load when opening the document. On the OAuth2 end-of-flow page, the openerOrigin request parameter was reflected back into the served page. Injected script runs in the victim's Grist origin and can act through the authenticated session, reading or modifying data and changing sharing settings and access rules. A document editor could therefore escalate to owner-level access. This issue is fixed in version 1.7.15.
CVSS v3.1
Score 7.7high
Affected software
pkg:github/gristlabs/grist-coreRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-55659 is a cross-site scripting vulnerability in gristlabs grist-core spreadsheet software versions before 1.7.15. The vulnerability arises because several server-rendered pages embed user-controlled values into HTML and inline scripts without adequate escaping. Specifically, document names or descriptions set by document editors and the OAuth2 end-of-flow openerOrigin parameter are reflected unsafely. An attacker can inject malicious scripts that execute within the victim's Grist origin, leveraging the authenticated session to read or modify data and alter sharing settings, effectively escalating privileges from editor to owner. The vulnerability has a CVSS 3.1 score of 7.7 (high severity) and is fixed in version 1.7.15.
Potential Impact
Exploitation of this vulnerability allows an attacker with document editor privileges to execute arbitrary scripts in the context of other users' sessions. This can lead to unauthorized reading or modification of data, and changes to sharing settings and access controls, resulting in privilege escalation to owner-level access. There are no known exploits in the wild as of the published date.
Mitigation Recommendations
Upgrade grist-core to version 1.7.15 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is documented. Patch status is confirmed fixed in 1.7.15.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-17T00:05:03.777Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a515e2368715ace43325a08
Added to database: 07/10/2026, 21:03:31 UTC
Last enriched: 07/18/2026, 15:36:57 UTC
Last updated: 08/25/2026, 10:52:10 UTC
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.