CVE-2026-55659

{"id": "CVE-2026-55659", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55659", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T16:01:16.076169Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gristlabs", "product": "grist-core", "versions": [{"status": "affected", "version": "< 1.7.15"}]}]}], "published": "2026-07-10T21:16:56.577", "references": [{"url": "https://github.com/gristlabs/grist-core/commit/4ced8064b7ea0e1763d5a6a2588b22774ce7efbc", "source": "security-advisories@github.com"}, {"url": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.15", "source": "security-advisories@github.com"}, {"url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-6qrq-h2h6-cw54", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-rendered Grist pages embedded user-controlled values into the page and into inline scripts without fully escaping them, allowing cross-site scripting. On the main application page, a document's name or description, set by a document editor, is rendered into the page that other users load when opening the document. On the OAuth2 end-of-flow page, the openerOrigin request parameter was reflected back into the served page. Injected script runs in the victim's Grist origin and can act through the authenticated session, reading or modifying data and changing sharing settings and access rules. A document editor could therefore escalate to owner-level access. This issue is fixed in version 1.7.15."}, {"lang": "es", "value": "Grist es un software de hoja de c\u00e1lculo que utiliza Python como su lenguaje de f\u00f3rmulas. Antes de la versi\u00f3n 1.7.15, varias p\u00e1ginas de Grist renderizadas por el servidor incrustaban valores controlados por el usuario en la p\u00e1gina y en scripts en l\u00ednea sin escaparlos completamente, permitiendo cross-site scripting. En la p\u00e1gina principal de la aplicaci\u00f3n, el nombre o la descripci\u00f3n de un documento, establecido por un editor de documentos, se renderiza en la p\u00e1gina que otros usuarios cargan al abrir el documento. En la p\u00e1gina de fin de flujo de OAuth2, el par\u00e1metro de solicitud openerOrigin se reflejaba de vuelta en la p\u00e1gina servida. El script inyectado se ejecuta en el origen de Grist de la v\u00edctima y puede actuar a trav\u00e9s de la sesi\u00f3n autenticada, leyendo o modificando datos y cambiando la configuraci\u00f3n de uso compartido y las reglas de acceso. Un editor de documentos podr\u00eda, por lo tanto, escalar a acceso de nivel de propietario. Este problema est\u00e1 solucionado en la versi\u00f3n 1.7.15."}], "lastModified": "2026-10-25T15:10:00.147", "sourceIdentifier": "security-advisories@github.com"}