CVE-2026-24002

Grist is spreadsheet software using Python as its formula language. Grist offers several methods for running those formulas in a sandbox, for cases where the user may be working with untrusted spreadsheets. One such method runs them in pyodide, but pyodide on node does not have a useful sandbox barrier. If a user of Grist sets `GRIST_SANDBOX_FLAVOR` to `pyodide` and opens a malicious document, that document could run arbitrary processes on the server hosting Grist. The problem has been addressed in Grist version 1.7.9 and up, by running pyodide under deno. As a workaround, a user can use the gvisor-based sandbox by setting `GRIST_SANDBOX_FLAVOR` to `gvisor`.

CVSS v3 9.0 CRITICAL

9.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.2 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/gristlabs/grist-core/security/advisories/GHSA-7xvx-8pf2-pv5g	Vendor Advisory
https://support.getgrist.com/self-managed/#how-do-i-sandbox-documents	Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:getgrist:grist-core:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-01-22 03:15

Updated : 2026-06-17 10:22

NVD link : CVE-2026-24002

Mitre link : CVE-2026-24002

CVE.ORG link : CVE-2026-24002

JSON object : View

Products Affected

getgrist

grist-core

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

{"id": "CVE-2026-24002", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24002", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-22T12:52:12.413052Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gristlabs", "product": "grist-core", "versions": [{"status": "affected", "version": "< 1.7.9"}]}]}], "published": "2026-01-22T03:15:47.777", "references": [{"url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-7xvx-8pf2-pv5g", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://support.getgrist.com/self-managed/#how-do-i-sandbox-documents", "tags": ["Patch"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-74"}]}], "descriptions": [{"lang": "en", "value": "Grist is spreadsheet software using Python as its formula language. Grist offers several methods for running those formulas in a sandbox, for cases where the user may be working with untrusted spreadsheets. One such method runs them in pyodide, but pyodide on node does not have a useful sandbox barrier. If a user of Grist sets `GRIST_SANDBOX_FLAVOR` to `pyodide` and opens a malicious document, that document could run arbitrary processes on the server hosting Grist. The problem has been addressed in Grist version 1.7.9 and up, by running pyodide under deno. As a workaround, a user can use the gvisor-based sandbox by setting `GRIST_SANDBOX_FLAVOR` to `gvisor`."}, {"lang": "es", "value": "Grist es un software de hoja de c\u00e1lculo que utiliza Python como su lenguaje de f\u00f3rmulas. Grist ofrece varios m\u00e9todos para ejecutar esas f\u00f3rmulas en un sandbox, para casos en los que el usuario podr\u00eda estar trabajando con hojas de c\u00e1lculo no confiables. Uno de esos m\u00e9todos los ejecuta en pyodide, pero pyodide en node no tiene una barrera de sandbox \u00fatil. Si un usuario de Grist establece 'GRIST_SANDBOX_FLAVOR' en 'pyodide' y abre un documento malicioso, ese documento podr\u00eda ejecutar procesos arbitrarios en el servidor que aloja Grist. El problema se ha abordado en Grist versi\u00f3n 1.7.9 y posteriores, ejecutando pyodide bajo deno. Como soluci\u00f3n alternativa, un usuario puede usar el sandbox basado en gvisor estableciendo 'GRIST_SANDBOX_FLAVOR' en 'gvisor'."}], "lastModified": "2026-06-17T10:22:27.640", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:getgrist:grist-core:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F8A7C5C-5BE0-4EA5-BB48-F038908933ED", "versionEndExcluding": "1.7.9"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}