CVE-2026-55665

Περιγραφή

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link-s href without scheme validation, so a javascript URL could run in a victim-s Grist origin on a single click. On the account-selection page, /welcome/select-account used its next query parameter as the account buttons- link target. In document tours, the GristDocTour table-s Link_URL column became a clickable button, allowing an editor of a shared document to store a javascript URL there that ran when another user opened the document and clicked the tour link. Because the script runs in the victim-s authenticated session, it can call Grist APIs as the victim, reading or modifying data and changing sharing settings and access rules. A document editor could therefore escalate to owner-level access. This issue is fixed in version 1.7.15.