CVE-2026-55665

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55665", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-17T00:05:03.777Z", "datePublished": "2026-07-10T20:58:24.755Z", "dateUpdated": "2026-07-14T14:11:49.064Z"}, "containers": {"cna": {"title": "DOM-based XSS in Grist via unsanitized links, enabling privilege escalation", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-7f6v-vghq-34xq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-7f6v-vghq-34xq"}, {"name": "https://github.com/gristlabs/grist-core/commit/5d0a90a162b5125fce7e8a86fb137eee5199dbde", "tags": ["x_refsource_MISC"], "url": "https://github.com/gristlabs/grist-core/commit/5d0a90a162b5125fce7e8a86fb137eee5199dbde"}, {"name": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.15", "tags": ["x_refsource_MISC"], "url": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.15"}], "affected": [{"vendor": "gristlabs", "product": "grist-core", "versions": [{"version": "< 1.7.15", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T20:58:24.755Z"}, "descriptions": [{"lang": "en", "value": "Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, so a javascript URL could run in a victim's Grist origin on a single click. On the account-selection page, /welcome/select-account used its next query parameter as the account buttons' link target. In document tours, the GristDocTour table's Link_URL column became a clickable button, allowing an editor of a shared document to store a javascript URL there that ran when another user opened the document and clicked the tour link. Because the script runs in the victim's authenticated session, it can call Grist APIs as the victim, reading or modifying data and changing sharing settings and access rules. A document editor could therefore escalate to owner-level access. This issue is fixed in version 1.7.15."}], "source": {"advisory": "GHSA-7f6v-vghq-34xq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-14T14:11:20.375073Z", "id": "CVE-2026-55665", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T14:11:49.064Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55665", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T14:11:20.375073Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T14:11:45.610Z"}}], "cna": {"title": "DOM-based XSS in Grist via unsanitized links, enabling privilege escalation", "source": {"advisory": "GHSA-7f6v-vghq-34xq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "gristlabs", "product": "grist-core", "versions": [{"status": "affected", "version": "< 1.7.15"}]}], "references": [{"url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-7f6v-vghq-34xq", "name": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-7f6v-vghq-34xq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gristlabs/grist-core/commit/5d0a90a162b5125fce7e8a86fb137eee5199dbde", "name": "https://github.com/gristlabs/grist-core/commit/5d0a90a162b5125fce7e8a86fb137eee5199dbde", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.15", "name": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.15", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, so a javascript URL could run in a victim's Grist origin on a single click. On the account-selection page, /welcome/select-account used its next query parameter as the account buttons' link target. In document tours, the GristDocTour table's Link_URL column became a clickable button, allowing an editor of a shared document to store a javascript URL there that ran when another user opened the document and clicked the tour link. Because the script runs in the victim's authenticated session, it can call Grist APIs as the victim, reading or modifying data and changing sharing settings and access rules. A document editor could therefore escalate to owner-level access. This issue is fixed in version 1.7.15."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T20:58:24.755Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55665", "state": "PUBLISHED", "dateUpdated": "2026-07-14T14:11:49.064Z", "dateReserved": "2026-06-17T00:05:03.777Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-10T20:58:24.755Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "grist-core", "vendor": "gristlabs", "versions": [{"status": "affected", "version": "< 1.7.15"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, so a javascript URL could run in a victim's Grist origin on a single click. On the account-selection page, /welcome/select-account used its next query parameter as the account buttons' link target. In document tours, the GristDocTour table's Link_URL column became a clickable button, allowing an editor of a shared document to store a javascript URL there that ran when another user opened the document and clicked the tour link. Because the script runs in the victim's authenticated session, it can call Grist APIs as the victim, reading or modifying data and changing sharing settings and access rules. A document editor could therefore escalate to owner-level access. This issue is fixed in version 1.7.15."}, {"lang": "es", "value": "Grist es un software de hoja de c\u00e1lculo que utiliza Python como su lenguaje de f\u00f3rmulas. Antes de la versi\u00f3n 1.7.15, Grist conten\u00eda dos vulnerabilidades de cross-site scripting donde un valor controlado por un atacante alcanzaba el href de un enlace sin validaci\u00f3n de esquema, por lo que una URL de javascript pod\u00eda ejecutarse en el origen de Grist de una v\u00edctima con un solo clic. En la p\u00e1gina de selecci\u00f3n de cuenta, /welcome/select-account utilizaba su par\u00e1metro de consulta \u2019next\u2019 como objetivo del enlace de los botones de cuenta. En los recorridos de documentos, la columna Link_URL de la tabla GristDocTour se convert\u00eda en un bot\u00f3n clicable, permitiendo a un editor de un documento compartido almacenar una URL de javascript all\u00ed que se ejecutaba cuando otro usuario abr\u00eda el documento y hac\u00eda clic en el enlace del recorrido. Debido a que el script se ejecuta en la sesi\u00f3n autenticada de la v\u00edctima, puede llamar a las API de Grist como la v\u00edctima, leyendo o modificando datos y cambiando la configuraci\u00f3n de uso compartido y las reglas de acceso. Un editor de documentos podr\u00eda, por lo tanto, escalar a acceso de nivel de propietario. Este problema est\u00e1 solucionado en la versi\u00f3n 1.7.15."}], "id": "CVE-2026-55665", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55665", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-14T14:11:20.375073Z", "version": "2.0.3"}}]}, "published": "2026-07-10T21:16:56.847", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/gristlabs/grist-core/commit/5d0a90a162b5125fce7e8a86fb137eee5199dbde"}, {"source": "security-advisories@github.com", "url": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.15"}, {"source": "security-advisories@github.com", "url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-7f6v-vghq-34xq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.7.15)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "grist-core", "source": "cna", "vendor": "gristlabs"}, "product": "grist-core", "vendor": "gristlabs"}], "created": "2026-07-10T22:30:04.414190+00:00", "updated": "2026-08-01T12:15:03.409631+00:00", "vendors": ["gristlabs", "gristlabs$PRODUCT$grist-core"]}