# CVE-2026-55665: Grist Labs Grist XSS in account selection and document tours

Source: https://junglewise.ai/threats/cve-2026-55665-grist-labs-grist-xss-in-account-selection-and-document-tours  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-55665 · Severity: info · CVSS 8.5 · Published 2026-07-10

Grist, a collaborative spreadsheet platform, was found to have security flaws that could allow an attacker to take over a user's account. By tricking a user into clicking a malicious link within the application—either on the account selection page or inside a shared document's "tour"—an attacker could execute unauthorized commands. This could allow an attacker to read private data, modify spreadsheet settings, or escalate their own access permissions to become a document owner.

Technologies: [Grist Labs Grist](https://junglewise.ai/threats/technologies/grist). Vendors: [Grist Labs](https://junglewise.ai/threats/vendors/grist-labs).

## Quick answers

**Is CVE-2026-55665 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55665 being exploited in the wild.

**How severe is CVE-2026-55665?** Informational severity, with a CVSS score of 8.5, published 10 July 2026.

**Which products and versions are affected?** Grist Labs Grist < 1.7.15; Grist Labs Grist-Core < 1.7.15.

**Is there a fix for CVE-2026-55665?** A patch was published on 2026-06-10: Version 1.7.15 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55665 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55665?** Check whether you run Grist Labs Grist or Grist Labs Grist-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Grist prior to version 1.7.15 is vulnerable to two DOM-based XSS flaws due to insufficient scheme validation on link 'href' attributes. The first vulnerability exists in the '/welcome/select-account' endpoint, which uses the 'next' query parameter as a link target without sanitization. The second exists in the 'GristDocTour' table, where the 'Link_URL' column is rendered as a clickable button. In both cases, an attacker can inject 'javascript:' URIs. When a victim clicks these links, the script executes within their authenticated session, allowing the attacker to call Grist APIs to read/modify data or modify access control rules, potentially escalating an editor's permissions to owner-level.

## Affected products

- Grist Labs Grist < 1.7.15
- Grist Labs grist-core < 1.7.15

## Timeline

- 2026-06-10: patched: Version 1.7.15 released
- 2026-06-19: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: CVE published to NVD

## References

- [https://github.com/gristlabs/grist-core/commit/5d0a90a162b5125fce7e8a86fb137eee5199dbde](https://github.com/gristlabs/grist-core/commit/5d0a90a162b5125fce7e8a86fb137eee5199dbde)
- [https://github.com/gristlabs/grist-core/releases/tag/v1.7.15](https://github.com/gristlabs/grist-core/releases/tag/v1.7.15)
- [https://github.com/gristlabs/grist-core/security/advisories/GHSA-7f6v-vghq-34xq](https://github.com/gristlabs/grist-core/security/advisories/GHSA-7f6v-vghq-34xq)

## Related threats

- [Grist Labs Grist improper authorization in GET /forms endpoint](https://junglewise.ai/threats/cve-2026-55664-grist-labs-grist-improper-authorization-in-get-forms-endpoint)
- [Grist Labs Grist XSS in server-rendered pages](https://junglewise.ai/threats/cve-2026-55659-grist-labs-grist-xss-in-server-rendered-pages)