CVE-2026-55665 Details

A cross-site scripting vulnerability has been identified in Grist spreadsheet software, prior to version 1.7.15. The issue arises because an attacker-controlled value could be injected into a link's href attribute without proper validation, allowing a javascript URL to execute in the context of the victim's Grist session. This vulnerability was present on the account-selection page and within document tours. On the account-selection page, the 'next' query parameter was used as the target for account buttons. In document tours, a shared document editor could insert a javascript URL into a table column that, when clicked by another user, would execute the script. Since the script ran in the context of the user's authenticated session, it could interact with Grist APIs, potentially leading to unauthorized data access or modifications, including changes to sharing settings and access rules. An editor could exploit this to gain owner-level access.

Users should update to Grist version 1.7.15 or later, where this vulnerability has been fixed. The update sanitizes link URLs to reject unsafe schemes before they are used, preventing the cross-site scripting issue.