CVE-2025-64752

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with access to any document on a Grist installation can use a feature for fetching from a URL that is executed on the server. The privileged network access of server-side requests could offer opportunities for attack escalation. This issue is fixed in version 1.7.7. The mitigation was to use the proxy for untrusted fetches intended for such purposes. As a workaround, avoid making http/https endpoints available to an instance running Grist that expose credentials or operate without credentials.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/gristlabs/grist-core/releases/tag/v1.7.7	Release Notes
https://github.com/gristlabs/grist-core/security/advisories/GHSA-qh95-2qv8-pqx3	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:getgrist:grist-core:*:*:*:*:*:*:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) grist-core es un servidor de alojamiento de hojas de cálculo. Versiones anteriores a la versión 1.7.7, un usuario con acceso a cualquier documento en una instalación de Grist puede usar una función para recuperar contenido desde una URL que se ejecuta en el servidor. El acceso privilegiado a la red de las solicitudes del lado del servidor podría ofrecer oportunidades para la escalada de ataques. Este problema se ha corregido en la versión 1.7.7. La mitigación fue usar el proxy para las recuperaciones no confiables destinadas a tales fines. Como solución alternativa, evite que los endpoints HTTP/HTTPS estén disponibles para una instancia que ejecuta Grist que expongan credenciales u operen sin credenciales.

Information

Published : 2025-11-13 22:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-64752

Mitre link : CVE-2025-64752

CVE.ORG link : CVE-2025-64752

JSON object : View

Products Affected

getgrist

grist-core

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2025-64752", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64752", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-14T16:25:04.348078Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gristlabs", "product": "grist-core", "versions": [{"status": "affected", "version": "< 1.7.7"}]}]}], "published": "2025-11-13T22:15:52.563", "references": [{"url": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.7", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-qh95-2qv8-pqx3", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with access to any document on a Grist installation can use a feature for fetching from a URL that is executed on the server. The privileged network access of server-side requests could offer opportunities for attack escalation. This issue is fixed in version 1.7.7. The mitigation was to use the proxy for untrusted fetches intended for such purposes. As a workaround, avoid making http/https endpoints available to an instance running Grist that expose credentials or operate without credentials."}, {"lang": "es", "value": "grist-core es un servidor de alojamiento de hojas de c\u00e1lculo. Versiones anteriores a la versi\u00f3n 1.7.7, un usuario con acceso a cualquier documento en una instalaci\u00f3n de Grist puede usar una funci\u00f3n para recuperar contenido desde una URL que se ejecuta en el servidor. El acceso privilegiado a la red de las solicitudes del lado del servidor podr\u00eda ofrecer oportunidades para la escalada de ataques. Este problema se ha corregido en la versi\u00f3n 1.7.7. La mitigaci\u00f3n fue usar el proxy para las recuperaciones no confiables destinadas a tales fines. Como soluci\u00f3n alternativa, evite que los endpoints HTTP/HTTPS est\u00e9n disponibles para una instancia que ejecuta Grist que expongan credenciales u operen sin credenciales."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:getgrist:grist-core:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4BAA1F5-E447-47A3-9824-ECA85B6B42B2", "versionEndExcluding": "1.7.7"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}