What’s Vulnerable › Products

gristlabs grist-core vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your gristlabs grist-core version is affected

Latest gristlabs grist-core vulnerabilities

• CVE-2026-55665 — DOM-based XSS in Grist via unsanitized links, enabling privilege escalation (CVSS 8.5)
• CVE-2026-55664 — Grist: Insufficient access control in the /forms endpoint exposes table metadata (CVSS 4.3)
• CVE-2026-55659 — Grist: XSS through unsafe value interpolation in server-rendered pages (CVSS 7.7)
• CVE-2026-24002 — pyodide sandbox option is insecure (CVSS 9.6)
• CVE-2025-64753 — grist-core has insufficient access control in endpoints for comparisons between documents and versions (CVSS 6.5)
• CVE-2025-64752 — grist-core has path to server-side requests via websocket (CVSS 6.5)
• CVE-2024-56359 — Cross-site Scripting vulnerability through HyperLink cells in grist-core (CVSS 6.1)
• CVE-2024-56358 — Cross-site Scripting vulnerability through svg attachment previews in grist-core (CVSS 6.1)
• CVE-2024-56357 — Cross-site Scripting vulnerability through custom widget URLs and form redirect URLs in grist-core (CVSS 6.1)