Medium severity · published Dec 20, 2024
CVE-2024-56358
Cross-site Scripting vulnerability through svg attachment previews in grist-core
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
grist-core is a spreadsheet hosting server. A user visiting a malicious document and previewing an attachment could have their account compromised, because JavaScript in an SVG file would be evaluated in the context of their current page. This issue has been patched in version 1.3.2. Users are advised to upgrade. Users unable to upgrade should avoid previewing attachments in documents prepared by people they do not trust.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grist-core · gristlabs
< 1.3.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-56358
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-56358
Patch
https://github.com/gristlabs/grist-core/commit/a792bdc43b456dbdd6fdc50d8747f4c349fab2f4
Vendor Advisory
https://github.com/gristlabs/grist-core/security/advisories/GHSA-jvfm-gf4f-33q3
More from grist-core
9.6
CVE-2026-24002
pyodide sandbox option is insecure
8.5
CVE-2026-55665
DOM-based XSS in Grist via unsanitized links, enabling privilege escalation
7.7
CVE-2026-55659
Grist: XSS through unsafe value interpolation in server-rendered pages
6.5
CVE-2025-64753
grist-core has insufficient access control in endpoints for comparisons between documents and versions
6.5
CVE-2025-64752
grist-core has path to server-side requests via websocket