CVE-2026-24002 Details
Description
Grist is spreadsheet software using Python as its formula language. Grist offers several methods for running those formulas in a sandbox, for cases where the user may be working with untrusted spreadsheets. One such method runs them in pyodide, but pyodide on node does not have a useful sandbox barrier. If a user of Grist sets `GRIST_SANDBOX_FLAVOR` to `pyodide` and opens a malicious document, that document could run arbitrary processes on the server hosting Grist. The problem has been addressed in Grist version 1.7.9 and up, by running pyodide under deno. As a workaround, a user can use the gvisor-based sandbox by setting `GRIST_SANDBOX_FLAVOR` to `gvisor`.
A critical vulnerability in Grist spreadsheet software allows arbitrary process execution on the server when formulas are run in a Pyodide sandbox. This issue affects Grist versions prior to 1.7.9. The vulnerability arises because Pyodide on Node lacks a proper sandbox barrier. Users can exploit this by setting the 'GRIST_SANDBOX_FLAVOR' environment variable to 'pyodide' and opening a malicious document. The vulnerability has been patched in Grist version 1.7.9 and later, which runs Pyodide under Deno, a more secure environment.
Users can upgrade to Grist version 1.7.9 or later, where this vulnerability is patched by running Pyodide under Deno. Alternatively, users can use the gvisor-based sandbox by setting 'GRIST_SANDBOX_FLAVOR' to 'gvisor'.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| getgrist grist-core | < 1.7.9 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 17, 2026 | Initial Analysis | [email protected] |
| Jan 22, 2026 | New CVE Received | [email protected] |