Medium severity · published Dec 20, 2024
CVE-2024-56357
Cross-site Scripting vulnerability through custom widget URLs and form redirect URLs in grist-core
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
grist-core is a spreadsheet hosting server. A user visiting a malicious document or submitting a malicious form could have their account compromised, because it was possible to use the `javascript:` scheme with custom widget URLs and form redirect URLs. This issue has been patched in version 1.3.1. Users are advised to upgrade. Users unable to upgrade should avoid visiting documents or forms prepared by people they do not trust.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grist-core · gristlabs
< 1.3.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-56357
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-56357
Patch
https://github.com/gristlabs/grist-core/commit/10b069005ec8d5f511e6554a56111d8f257f029e
Vendor Advisory
https://github.com/gristlabs/grist-core/security/advisories/GHSA-cq5q-cqr7-vmf6
More from grist-core
9.6
CVE-2026-24002
pyodide sandbox option is insecure
8.5
CVE-2026-55665
DOM-based XSS in Grist via unsanitized links, enabling privilege escalation
7.7
CVE-2026-55659
Grist: XSS through unsafe value interpolation in server-rendered pages
6.5
CVE-2025-64753
grist-core has insufficient access control in endpoints for comparisons between documents and versions
6.5
CVE-2025-64752
grist-core has path to server-side requests via websocket