Executive brief
Grist is a collaborative spreadsheet platform that uses Python for formulas. A security flaw allowed malicious users with document editing permissions to inject malicious scripts into document names or descriptions. When other users, including administrators, view these documents, the script could run in their browser, allowing the attacker to steal data, modify access rules, or take over the entire document workspace.
Technical details
A cross-site scripting (XSS) vulnerability exists in Grist prior to version 1.7.15 due to improper neutralization of user-controlled input during server-side rendering. Specifically, document names and descriptions (stored) and the 'openerOrigin' OAuth2 request parameter (reflected) were embedded into inline <script> blocks without sufficient escaping. The root cause involved unsafe string interpolation where special replacement patterns (like