Advisories · Technology
gristlabs grist-core.
Every CVE that names gristlabs grist-core among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.3 Medium
Grist: Insufficient access control in the /forms endpoint exposes table metadata
- gristlabs grist-core
- Information disclosure
- Broken access control
- CVSS 8.5 High
DOM-based XSS in Grist via unsanitized links, enabling privilege escalation
- gristlabs grist-core
- Cross-site scripting (XSS)
- CVSS 7.7 High
Grist: XSS through unsafe value interpolation in server-rendered pages
- gristlabs grist-core
- Cross-site scripting (XSS)
- CWE-116
- CVSS 9.1 CriticalCritical · CVSS 9+
pyodide sandbox option is insecure
- gristlabs grist-core
- Other injection
- CVSS 5.3 Medium
grist-core has insufficient access control in endpoints for comparisons between documents and versions
- gristlabs grist-core
- Broken access control
- CVSS 6.8 Medium
grist-core has path to server-side requests via websocket
- gristlabs grist-core
- Server-side request forgery (SSRF)
- CVSS 8.1 High
Cross-site Scripting vulnerability through HyperLink cells in grist-core
- gristlabs grist-core
- Cross-site scripting (XSS)
- CVSS 8.1 High
Cross-site Scripting vulnerability through svg attachment previews in grist-core
- gristlabs grist-core
- Cross-site scripting (XSS)
- CVSS 8.1 High
Cross-site Scripting vulnerability through custom widget URLs and form redirect URLs in grist-core
- gristlabs grist-core
- Cross-site scripting (XSS)