CVE-2026-55659

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-rendered Grist pages embedded user-controlled values into the page and into inline scripts without fully escaping them, allowing cross-site scripting. On the main application page, a document's name or description, set by a document editor, is rendered into the page that other users load when opening the document. On the OAuth2 end-of-flow page, the openerOrigin request parameter was reflected back into the served page. Injected script runs in the victim's Grist origin and can act through the authenticated session, reading or modifying data and changing sharing settings and access rules. A document editor could therefore escalate to owner-level access. This issue is fixed in version 1.7.15.

• CWE-79
• CWE-116

• https://github.com/gristlabs/grist-core/commit/4ced8064b7ea0e1763d5a6a2588b22774ce7efbc
• https://github.com/gristlabs/grist-core/releases/tag/v1.7.15
• https://github.com/gristlabs/grist-core/security/advisories/GHSA-6qrq-h2h6-cw54

Published

Jul 10, 2026

Last Modified

Jul 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5565A security vulnerability has been detected in code-projects …7.3
• CVE-2026-55651Easy!Appointments is a self hosted appointment scheduler. In…7.1
• CVE-2026-55652Wekan is open source kanban built with Meteor. Prior to 9.46…9.8
• CVE-2026-55653A flaw was found in OpenSSH. A malicious SSH server can expl…6.5
• CVE-2026-55654A flaw was found in OpenSSH. This vulnerability, a heap out-…3.7
• CVE-2026-55655A flaw was found in OpenSSH. A local unprivileged attacker o…6.1
• CVE-2026-5566A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7…8.8
• CVE-2026-55660Tina is a headless content management system. In versions pr…7.6
• CVE-2026-55661Tina is a headless content management system. In versions pr…4.8
• CVE-2026-55664Grist is spreadsheet software using Python as its formula la…4.3
• CVE-2026-55665Grist is spreadsheet software using Python as its formula la…8.5
• CVE-2026-55666Rocket.Chat is an open-source, secure, fully customizable co…9.3