Threat Intelligence Database

Grist-core versions prior to 1.7.15 contain two cross-site scripting (XSS) vulnerabilities. These arise from improper validation of attacker-controlled input used in link href attributes, allowing javascript URLs to execute in the victim's authenticated session. Exploitation can occur via the account-selection page's next parameter or through the Link_URL column in document tours. Successful exploitation enables an attacker with document editor access to escalate privileges to owner-level by invoking Grist APIs as the victim. The issue is fixed in version 1.7.15.

A vulnerability in gristlabs grist-core prior to version 1.7.15 allows users with partial read access to retrieve table and column metadata via the GET /forms endpoint without proper access control. This exposure occurs because the endpoint does not enforce document access rules or verify that the requested section is a form, potentially revealing sensitive structural information even in documents without forms. The issue is fixed in version 1.7.15.

A cross-site scripting (XSS) vulnerability exists in gristlabs grist-core prior to version 1.7.15. Several server-rendered pages embed user-controlled input without proper escaping, including document names, descriptions, and an OAuth2 parameter. Exploitation allows injected scripts to run in the victim's Grist origin, potentially enabling escalation from document editor to owner-level access. This vulnerability is fixed in version 1.7.15.