CVE Explorer

CVE-2026-24002

Grist is spreadsheet software using Python as its formula language. Grist offers several methods for running those formulas in a sandbox, for cases where the user may be working with untrusted spreadsheets. One such method runs them in pyodide, but pyodide on node does not have a useful sandbox barrier. If a user of Grist sets `GRIST_SANDBOX_FLAVOR` to `pyodide` and opens a malicious document, that document could run arbitrary processes on the server hosting Grist. The problem has been addressed

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:a6a0d30ed8d992923487284590a24098c2cc4780b684d1d2f297190e3333562b

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"grist-core","vendor":"gristlabs","versions":[{"status":"affected","version":"< 1.7.9"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:8002019c91f4cfadae602463ed4ac8fcf07c2df9949085f1913e84684aa4ad87 · sha256:ae4380bc9b810a39… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:8002019c91f4cfadae602463ed4ac8fcf07c2df9949085f1913e84684aa4ad87 · sha256:ae4380bc9b810a39… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-74","description":"CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:8002019c91f4cfadae602463ed4ac8fcf07c2df9949085f1913e84684aa4ad87 · sha256:ae4380bc9b810a39… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"name":"https://github.com/gristlabs/grist-core/security/advisories/GHSA-7xvx-8pf2-pv5g","tags":["x_refsource_CONFIRM"],"url":"https://github.com/gristlabs/grist-core/security/advisories/GHSA-7xvx-8pf2-pv5g"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:8002019c91f4cfadae602463ed4ac8fcf07c2df9949085f1913e84684aa4ad87 · sha256:ae4380bc9b810a39… · /containers/cna/references/0

{"name":"https://support.getgrist.com/self-managed/#how-do-i-sandbox-documents","tags":["x_refsource_MISC"],"url":"https://support.getgrist.com/self-managed/#how-do-i-sandbox-documents"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:8002019c91f4cfadae602463ed4ac8fcf07c2df9949085f1913e84684aa4ad87 · sha256:ae4380bc9b810a39… · /containers/cna/references/1

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer