← Vulnerability feed

Vulnerability record · CVE-2026-24002 · published 22 January 2026

CVE-2026-24002: Getgrist grist-core injection vulnerability

Getgrist · Grist Core

Grist is spreadsheet software using Python as its formula language. Grist offers several methods for running those formulas in a sandbox, for cases where the user may be working with untrusted spreadsheets. One such method runs them in pyodide, but pyodide on node does not have a useful sandbox barrier. If a user of Grist sets `GRIST_SANDBOX_FLAVOR` to `pyodide` and opens a malicious document, that document could run arbitrary processes on the server hosting Grist. The problem has been addressed in Grist version 1.7.9 and up, by running pyodide under deno. As a workaround, a user can use the gvisor-based sandbox by setting `GRIST_SANDBOX_FLAVOR` to `gvisor`.

9.6 CVSS 3.1 Critical EPSS 0.52% · top 57.9% CWE-74 · Injection
9.6CVSS 3.1 base score
0.52%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Grist is spreadsheet software using Python as its formula language. Grist offers several methods for running those formulas in a sandbox, for cases where the user may be working with untrusted spreadsheets. One such method runs them in pyodide, but pyodide on node does not have a useful sandbox barrier. If a user of Grist sets `GRIST_SANDBOX_FLAVOR` to `pyodide` and opens a malicious document, that document could run arbitrary processes on the server hosting Grist. The problem has been addressed in Grist version 1.7.9 and up, by running pyodide under deno. As a workaround, a user can use the gvisor-based sandbox by setting `GRIST_SANDBOX_FLAVOR` to `gvisor`.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/gristlabs/grist-core/security/advisories/GHSA-7xvx-8pf2-pv5g Vendor Advisory
https://support.getgrist.com/self-managed/#how-do-i-sandbox-documents Patch

Track CVE-2026-24002 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.5CVE-2025-64752Getgrist grist-core server-side request forgery (ssrf) vulnerabilitygrist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with access to any document on a Grist installation can use a feature for …EPSS 0.23%6.5CVE-2025-64753Getgrist grist-core incorrect authorization vulnerabilitygrist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints l…EPSS 0.22%6.1CVE-2024-56357Getgrist grist-core cross-site scripting vulnerabilitygrist-core is a spreadsheet hosting server. A user visiting a malicious document or submitting a malicious form could have their account compromised,…EPSS 0.31%6.1CVE-2024-56358Getgrist grist-core cross-site scripting vulnerabilitygrist-core is a spreadsheet hosting server. A user visiting a malicious document and previewing an attachment could have their account compromised, b…EPSS 0.30%6.1CVE-2024-56359Getgrist grist-core cross-site scripting vulnerabilitygrist-core is a spreadsheet hosting server. A user visiting a malicious document and clicking on a link in a HyperLink cell using a control modifier …EPSS 0.32%10.0CVE-2025-20337Cisco ISE API input validation flaw allows unauthenticated root RCECisco ISE and ISE-PIC fail to properly validate user-supplied input in a specific API, letting an unauthenticated remote attacker execute arbitrary c…KEVEPSS 68%analysed10.0CVE-2025-20281Cisco ISE API unauthenticated remote code executionCisco ISE and ISE-PIC fail to properly validate user-supplied input in a specific API, allowing a crafted request to reach the underlying operating s…KEVEPSS 98%analysed7.2CVE-2022-43769Hitachi Vantara Pentaho BA Server Spring Template InjectionHitachi Vantara Pentaho Business Analytics Server before 9.4.0.1 and 9.3.0.2, including 8.3.x, allows certain web services to set property values con…KEVEPSS 98%analysed

Source: NIST National Vulnerability Database (record CVE-2026-24002), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.