CVE-2026-55665
DOM-based XSS in Grist via unsanitized links, enabling privilege escalation
Description
Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, so a javascript URL could run in a victim's Grist origin on a single click. On the account-selection page, /welcome/select-account used its next query parameter as the account buttons' link target. In document tours, the GristDocTour table's Link_URL column became a clickable button, allowing an editor of a shared document to store a javascript URL there that ran when another user opened the document and clicked the tour link. Because the script runs in the victim's authenticated session, it can call Grist APIs as the victim, reading or modifying data and changing sharing settings and access rules. A document editor could therefore escalate to owner-level access. This issue is fixed in version 1.7.15.
INFO
Published Date :
July 10, 2026, 9:16 p.m.
Last Modified :
Oct. 25, 2026, 3:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-55665
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update Grist to version 1.7.15 or later.
- Validate URL schemes before using them in href attributes.
- Sanitize user-supplied input for link URLs.
- Review and restrict sharing settings and access rules.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-55665.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-55665 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-55665
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-55665 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-55665 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 25, 2026
Action Type Old Value New Value Added Translation Title: grist-core de gristlabs, Description: Grist es un software de hoja de cálculo que utiliza Python como su lenguaje de fórmulas. Antes de la versión 1.7.15, Grist contenía dos vulnerabilidades de cross-site scripting donde un valor controlado por un atacante alcanzaba el href de un enlace sin validación de esquema, por lo que una URL de javascript podía ejecutarse en el origen de Grist de una víctima con un solo clic. En la página de selección de cuenta, /welcome/select-account utilizaba su parámetro de consulta ’next’ como objetivo del enlace de los botones de cuenta. En los recorridos de documentos, la columna Link_URL de la tabla GristDocTour se convertía en un botón clicable, permitiendo a un editor de un documento compartido almacenar una URL de javascript allí que se ejecutaba cuando otro usuario abría el documento y hacía clic en el enlace del recorrido. Debido a que el script se ejecuta en la sesión autenticada de la víctima, puede llamar a las API de Grist como la víctima, leyendo o modificando datos y cambiando la configuración de uso compartido y las reglas de acceso. Un editor de documentos podría, por lo tanto, escalar a acceso de nivel de propietario. Este problema está solucionado en la versión 1.7.15. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 14, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-55665', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-07-14T14:11:20.375073Z'} -
New CVE Received by [email protected]
Jul. 10, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'gristlabs', 'product': 'grist-core', 'versions': [{'status': 'affected', 'version': '< 1.7.15'}]}] Added Description Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, so a javascript URL could run in a victim's Grist origin on a single click. On the account-selection page, /welcome/select-account used its next query parameter as the account buttons' link target. In document tours, the GristDocTour table's Link_URL column became a clickable button, allowing an editor of a shared document to store a javascript URL there that ran when another user opened the document and clicked the tour link. Because the script runs in the victim's authenticated session, it can call Grist APIs as the victim, reading or modifying data and changing sharing settings and access rules. A document editor could therefore escalate to owner-level access. This issue is fixed in version 1.7.15. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-79 Added Reference https://github.com/gristlabs/grist-core/commit/5d0a90a162b5125fce7e8a86fb137eee5199dbde Added Reference https://github.com/gristlabs/grist-core/releases/tag/v1.7.15 Added Reference https://github.com/gristlabs/grist-core/security/advisories/GHSA-7f6v-vghq-34xq