Grist-core, a spreadsheet software using Python for formulas, had two XSS vulnerabilities before version 1.7.15. The vulnerabilities stem from lack of scheme validation on attacker-controlled values used in link hrefs. On the /welcome/select-account page, the next query parameter was used directly as a link target, enabling javascript URL execution on click. Additionally, the Link_URL column in the GristDocTour table allowed editors to insert javascript URLs that execute when other users click the tour links. Because the script runs in the victim's authenticated session, it can call Grist APIs with the victim's privileges, allowing data reading, modification, and sharing setting changes. This enables privilege escalation from editor to owner. The vulnerabilities are resolved in Grist-core 1.7.15.

Exploitation allows an attacker with editor-level access to execute arbitrary JavaScript in the context of the victim's authenticated session. This can lead to unauthorized reading and modification of data, as well as changes to sharing settings and access rules. Ultimately, an attacker can escalate privileges to owner-level access within Grist-core.

A fix is available in Grist-core version 1.7.15. Users should upgrade to version 1.7.15 or later to remediate these vulnerabilities. No other mitigation guidance is provided or necessary as the issue is resolved by this update.