Skip to contentGristlabs Grist-core vulnerabilities
- gristlabs grist-coreGrist: Insufficient access control in the /forms endpoint exposes table metadataCVE-2026-556644.3 Medium
- gristlabs grist-coreDOM-based XSS in Grist via unsanitized links, enabling privilege escalationCVE-2026-556658.5 High
- gristlabs grist-coreGrist: XSS through unsafe value interpolation in server-rendered pagesCVE-2026-556597.7 High
- getgrist grist-corepyodide sandbox option is insecureCVE-2026-240029.1 Critical
- getgrist grist-coregrist-core has insufficient access control in endpoints for comparisons between documents and versionsCVE-2025-647535.3 Medium
- getgrist grist-coregrist-core has path to server-side requests via websocketCVE-2025-647526.8 Medium
- getgrist grist-coreCross-site Scripting vulnerability through HyperLink cells in grist-coreCVE-2024-563598.1 High
- getgrist grist-coreCross-site Scripting vulnerability through svg attachment previews in grist-coreCVE-2024-563588.1 High
- getgrist grist-coreCross-site Scripting vulnerability through custom widget URLs and form redirect URLs in grist-coreCVE-2024-563578.1 High