Junglewise Threat Intelligence

CVE-2026-55659: Grist Labs Grist XSS in server-rendered pages

CVE-2026-55659 · Severity: high · CVSS 7.7 · Published 2026-07-10

Technologies: Grist Labs Grist. Vendors: Grist Labs.

Executive brief

Grist is a collaborative spreadsheet platform that uses Python for formulas. A security flaw allowed malicious users with document editing permissions to inject malicious scripts into document names or descriptions. When other users, including administrators, view these documents, the script could run in their browser, allowing the attacker to steal data, modify access rules, or take over the entire document workspace.

Technical details

A cross-site scripting (XSS) vulnerability exists in Grist prior to version 1.7.15 due to improper neutralization of user-controlled input during server-side rendering. Specifically, document names and descriptions (stored) and the 'openerOrigin' OAuth2 request parameter (reflected) were embedded into inline <script> blocks without sufficient escaping. The root cause involved unsafe string interpolation where special replacement patterns (like and

amp;) were interpreted by the template engine. An attacker with 'editor' permissions can exploit this to execute arbitrary JavaScript in the context of other users' sessions. This allows for unauthorized data access, modification of sharing settings, and privilege escalation to 'owner'. The fix involves context-aware escaping using jsesc and literal string replacement.

Affected products

  • Grist Labs Grist < 1.7.15

Timeline

  • 2026-06-10: patched: Version 1.7.15 released
  • 2026-06-17: advisory: GitHub Security Advisory published
  • 2026-07-10: disclosed: CVE published to NVD

References

Related threats