Medium severity · published Dec 20, 2024
CVE-2024-56359
Cross-site Scripting vulnerability through HyperLink cells in grist-core
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
grist-core is a spreadsheet hosting server. A user visiting a malicious document and clicking on a link in a HyperLink cell using a control modifier (meaning for example Ctrl+click) could have their account compromised, since the link could use the javascript: scheme and be evaluated in the context of their current page. This issue has been patched in version 1.3.2. Users are advised to upgrade. Users unable to upgrade should avoid clicking on HyperLink cell links using a control modifier in documents prepared by people they do not trust.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grist-core · gristlabs
< 1.3.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-56359
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-56359
Patch
https://github.com/gristlabs/grist-core/commit/a792bdc43b456dbdd6fdc50d8747f4c349fab2f4
Vendor Advisory
https://github.com/gristlabs/grist-core/security/advisories/GHSA-qv69-5cj2-53r9
More from grist-core
9.6
CVE-2026-24002
pyodide sandbox option is insecure
8.5
CVE-2026-55665
DOM-based XSS in Grist via unsanitized links, enabling privilege escalation
7.7
CVE-2026-55659
Grist: XSS through unsafe value interpolation in server-rendered pages
6.5
CVE-2025-64753
grist-core has insufficient access control in endpoints for comparisons between documents and versions
6.5
CVE-2025-64752
grist-core has path to server-side requests via websocket