CVE Explorer
CVE-2026-55665
Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, so a javascript URL could run in a victim's Grist origin on a single click. On the account-selection page, /welcome/select-account used its next query parameter as the account buttons' link target. In document tours, the GristDocTour table's Link_URL column became a clickab
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"grist-core","vendor":"gristlabs","versions":[{"status":"affected","version":"< 1.7.15"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:809e2a859c9655c6a615352afddaf7426ffda284331a4e9facbf654c210091d6 · sha256:00952d5b354f7f24… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.5,"baseSeverity":"HIGH","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH"},"metric_type":"cvssV4_0"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:809e2a859c9655c6a615352afddaf7426ffda284331a4e9facbf654c210091d6 · sha256:00952d5b354f7f24… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-79","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:809e2a859c9655c6a615352afddaf7426ffda284331a4e9facbf654c210091d6 · sha256:00952d5b354f7f24… · /containers/cna/problemTypes/0/descriptions/0
Source references
3 source assertions{"name":"https://github.com/gristlabs/grist-core/commit/5d0a90a162b5125fce7e8a86fb137eee5199dbde","tags":["x_refsource_MISC"],"url":"https://github.com/gristlabs/grist-core/commit/5d0a90a162b5125fce7e8a86fb137eee5199dbde"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:809e2a859c9655c6a615352afddaf7426ffda284331a4e9facbf654c210091d6 · sha256:00952d5b354f7f24… · /containers/cna/references/1
{"name":"https://github.com/gristlabs/grist-core/releases/tag/v1.7.15","tags":["x_refsource_MISC"],"url":"https://github.com/gristlabs/grist-core/releases/tag/v1.7.15"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:809e2a859c9655c6a615352afddaf7426ffda284331a4e9facbf654c210091d6 · sha256:00952d5b354f7f24… · /containers/cna/references/2
{"name":"https://github.com/gristlabs/grist-core/security/advisories/GHSA-7f6v-vghq-34xq","tags":["x_refsource_CONFIRM"],"url":"https://github.com/gristlabs/grist-core/security/advisories/GHSA-7f6v-vghq-34xq"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:809e2a859c9655c6a615352afddaf7426ffda284331a4e9facbf654c210091d6 · sha256:00952d5b354f7f24… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.