CVE-2026-55665 (GCVE-0-2026-55665)
Vulnerability from cvelistv5 – Published: 2026-07-10 20:58 – Updated: 2026-07-14 14:11
VLAI
EPSS
VEX
Title
DOM-based XSS in Grist via unsanitized links, enabling privilege escalation
Summary
Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, so a javascript URL could run in a victim's Grist origin on a single click. On the account-selection page, /welcome/select-account used its next query parameter as the account buttons' link target. In document tours, the GristDocTour table's Link_URL column became a clickable button, allowing an editor of a shared document to store a javascript URL there that ran when another user opened the document and clicked the tour link. Because the script runs in the victim's authenticated session, it can call Grist APIs as the victim, reading or modifying data and changing sharing settings and access rules. A document editor could therefore escalate to owner-level access. This issue is fixed in version 1.7.15.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-14 14:11 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/gristlabs/grist-core/security/… | x_refsource_CONFIRM |
| https://github.com/gristlabs/grist-core/commit/5d… | x_refsource_MISC |
| https://github.com/gristlabs/grist-core/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| gristlabs | grist-core |
Affected:
< 1.7.15
|
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55665",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-14T14:11:20.375073Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T14:11:49.064Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "grist-core",
"vendor": "gristlabs",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.15"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link\u0027s href without scheme validation, so a javascript URL could run in a victim\u0027s Grist origin on a single click. On the account-selection page, /welcome/select-account used its next query parameter as the account buttons\u0027 link target. In document tours, the GristDocTour table\u0027s Link_URL column became a clickable button, allowing an editor of a shared document to store a javascript URL there that ran when another user opened the document and clicked the tour link. Because the script runs in the victim\u0027s authenticated session, it can call Grist APIs as the victim, reading or modifying data and changing sharing settings and access rules. A document editor could therefore escalate to owner-level access. This issue is fixed in version 1.7.15."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T20:58:24.755Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-7f6v-vghq-34xq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-7f6v-vghq-34xq"
},
{
"name": "https://github.com/gristlabs/grist-core/commit/5d0a90a162b5125fce7e8a86fb137eee5199dbde",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gristlabs/grist-core/commit/5d0a90a162b5125fce7e8a86fb137eee5199dbde"
},
{
"name": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.15",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.15"
}
],
"source": {
"advisory": "GHSA-7f6v-vghq-34xq",
"discovery": "UNKNOWN"
},
"title": "DOM-based XSS in Grist via unsanitized links, enabling privilege escalation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55665",
"datePublished": "2026-07-10T20:58:24.755Z",
"dateReserved": "2026-06-17T00:05:03.777Z",
"dateUpdated": "2026-07-14T14:11:49.064Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-55665",
"date": "2026-10-27",
"epss": "0.00529",
"percentile": "0.44578"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "grist-core",
"vendor": "gristlabs",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.15"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link\u0027s href without scheme validation, so a javascript URL could run in a victim\u0027s Grist origin on a single click. On the account-selection page, /welcome/select-account used its next query parameter as the account buttons\u0027 link target. In document tours, the GristDocTour table\u0027s Link_URL column became a clickable button, allowing an editor of a shared document to store a javascript URL there that ran when another user opened the document and clicked the tour link. Because the script runs in the victim\u0027s authenticated session, it can call Grist APIs as the victim, reading or modifying data and changing sharing settings and access rules. A document editor could therefore escalate to owner-level access. This issue is fixed in version 1.7.15."
},
{
"lang": "es",
"value": "Grist es un software de hoja de c\u00e1lculo que utiliza Python como su lenguaje de f\u00f3rmulas. Antes de la versi\u00f3n 1.7.15, Grist conten\u00eda dos vulnerabilidades de cross-site scripting donde un valor controlado por un atacante alcanzaba el href de un enlace sin validaci\u00f3n de esquema, por lo que una URL de javascript pod\u00eda ejecutarse en el origen de Grist de una v\u00edctima con un solo clic. En la p\u00e1gina de selecci\u00f3n de cuenta, /welcome/select-account utilizaba su par\u00e1metro de consulta \u2019next\u2019 como objetivo del enlace de los botones de cuenta. En los recorridos de documentos, la columna Link_URL de la tabla GristDocTour se convert\u00eda en un bot\u00f3n clicable, permitiendo a un editor de un documento compartido almacenar una URL de javascript all\u00ed que se ejecutaba cuando otro usuario abr\u00eda el documento y hac\u00eda clic en el enlace del recorrido. Debido a que el script se ejecuta en la sesi\u00f3n autenticada de la v\u00edctima, puede llamar a las API de Grist como la v\u00edctima, leyendo o modificando datos y cambiando la configuraci\u00f3n de uso compartido y las reglas de acceso. Un editor de documentos podr\u00eda, por lo tanto, escalar a acceso de nivel de propietario. Este problema est\u00e1 solucionado en la versi\u00f3n 1.7.15."
}
],
"id": "CVE-2026-55665",
"lastModified": "2026-10-25T15:10:00.147",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-55665",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-14T14:11:20.375073Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-07-10T21:16:56.847",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/gristlabs/grist-core/commit/5d0a90a162b5125fce7e8a86fb137eee5199dbde"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.15"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-7f6v-vghq-34xq"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55665",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-14T14:11:20.375073Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T14:11:45.610Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "grist-core",
"vendor": "gristlabs",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.15"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link\u0027s href without scheme validation, so a javascript URL could run in a victim\u0027s Grist origin on a single click. On the account-selection page, /welcome/select-account used its next query parameter as the account buttons\u0027 link target. In document tours, the GristDocTour table\u0027s Link_URL column became a clickable button, allowing an editor of a shared document to store a javascript URL there that ran when another user opened the document and clicked the tour link. Because the script runs in the victim\u0027s authenticated session, it can call Grist APIs as the victim, reading or modifying data and changing sharing settings and access rules. A document editor could therefore escalate to owner-level access. This issue is fixed in version 1.7.15."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T20:58:24.755Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-7f6v-vghq-34xq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-7f6v-vghq-34xq"
},
{
"name": "https://github.com/gristlabs/grist-core/commit/5d0a90a162b5125fce7e8a86fb137eee5199dbde",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gristlabs/grist-core/commit/5d0a90a162b5125fce7e8a86fb137eee5199dbde"
},
{
"name": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.15",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.15"
}
],
"source": {
"advisory": "GHSA-7f6v-vghq-34xq",
"discovery": "UNKNOWN"
},
"title": "DOM-based XSS in Grist via unsanitized links, enabling privilege escalation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55665",
"datePublished": "2026-07-10T20:58:24.755Z",
"dateReserved": "2026-06-17T00:05:03.777Z",
"dateUpdated": "2026-07-14T14:11:49.064Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.