Grist-core, a spreadsheet software using Python for formulas, had two XSS vulnerabilities before version 1.7.15. The first vulnerability is on the /welcome/select-account page, where the 'next' query parameter is used directly as the target for account buttons without validating the URL scheme, allowing javascript: URLs to execute. The second vulnerability is in document tours, where the Link_URL column in the GristDocTour table is rendered as a clickable button; an editor can insert a javascript URL that executes when another user clicks the link. Because the script runs in the victim's authenticated session, it can invoke Grist APIs to read or modify data and change sharing settings, enabling privilege escalation from editor to owner. The vulnerabilities are fixed in Grist-core version 1.7.15.

Successful exploitation allows an attacker with editor-level access to execute arbitrary JavaScript in the context of the victim's authenticated session. This can lead to unauthorized reading or modification of data, and changes to sharing settings and access controls, effectively escalating privileges to owner-level access within Grist-core.

Upgrade Grist-core to version 1.7.15 or later, where these cross-site scripting vulnerabilities have been fixed. No other official remediation or temporary fixes are documented. Users should apply this update promptly to prevent exploitation.