Executive brief
Grist, a collaborative spreadsheet platform, was found to have security flaws that could allow an attacker to take over a user's account. By tricking a user into clicking a malicious link within the application—either on the account selection page or inside a shared document's "tour"—an attacker could execute unauthorized commands. This could allow an attacker to read private data, modify spreadsheet settings, or escalate their own access permissions to become a document owner.
Technical details
Grist prior to version 1.7.15 is vulnerable to two DOM-based XSS flaws due to insufficient scheme validation on link 'href' attributes. The first vulnerability exists in the '/welcome/select-account' endpoint, which uses the 'next' query parameter as a link target without sanitization. The second exists in the 'GristDocTour' table, where the 'Link_URL' column is rendered as a clickable button. In both cases, an attacker can inject 'javascript:' URIs. When a victim clicks these links, the script executes within their authenticated session, allowing the attacker to call Grist APIs to read/modify data or modify access control rules, potentially escalating an editor's permissions to owner-level.
Affected products
- Grist Labs Grist < 1.7.15
- Grist Labs grist-core < 1.7.15
Timeline
- 2026-06-10: patched: Version 1.7.15 released
- 2026-06-19: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: CVE published to NVD