CVE-2026-55665: Grist Labs Grist XSS in account selection and document tours

CVE-2026-55665 · Severity: info · CVSS 8.5 · Published 2026-07-10

Grist, a collaborative spreadsheet platform, was found to have security flaws that could allow an attacker to take over a user's account. By tricking a user into clicking a malicious link within the application—either on the account selection page or inside a shared document's "tour"—an attacker could execute unauthorized commands. This could allow an attacker to read private data, modify spreadsheet settings, or escalate their own access permissions to become a document owner.

Technologies: Grist Labs Grist. Vendors: Grist Labs.

Quick answers

Is CVE-2026-55665 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55665 being exploited in the wild.
How severe is CVE-2026-55665?
Informational severity, with a CVSS score of 8.5, published 10 July 2026.
Which products and versions are affected?
Grist Labs Grist < 1.7.15; Grist Labs Grist-Core < 1.7.15.
Is there a fix for CVE-2026-55665?
A patch was published on 2026-06-10: Version 1.7.15 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55665 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-55665?
Check whether you run Grist Labs Grist or Grist Labs Grist-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Grist prior to version 1.7.15 is vulnerable to two DOM-based XSS flaws due to insufficient scheme validation on link 'href' attributes. The first vulnerability exists in the '/welcome/select-account' endpoint, which uses the 'next' query parameter as a link target without sanitization. The second exists in the 'GristDocTour' table, where the 'Link_URL' column is rendered as a clickable button. In both cases, an attacker can inject 'javascript:' URIs. When a victim clicks these links, the script executes within their authenticated session, allowing the attacker to call Grist APIs to read/modify data or modify access control rules, potentially escalating an editor's permissions to owner-level.

Affected products

  • Grist Labs Grist < 1.7.15
  • Grist Labs grist-core < 1.7.15

Timeline

  • 2026-06-10: patched: Version 1.7.15 released
  • 2026-06-19: advisory: GitHub Security Advisory published
  • 2026-07-10: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.