CVE-2026-55659

{
  "id": "CVE-2026-55659",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-10T21:16:56.577",
  "lastModified": "2026-10-25T15:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-rendered Grist pages embedded user-controlled values into the page and into inline scripts without fully escaping them, allowing cross-site scripting. On the main application page, a document's name or description, set by a document editor, is rendered into the page that other users load when opening the document. On the OAuth2 end-of-flow page, the openerOrigin request parameter was reflected back into the served page. Injected script runs in the victim's Grist origin and can act through the authenticated session, reading or modifying data and changing sharing settings and access rules. A document editor could therefore escalate to owner-level access. This issue is fixed in version 1.7.15."
    },
    {
      "lang": "es",
      "value": "Grist es un software de hoja de cálculo que utiliza Python como su lenguaje de fórmulas. Antes de la versión 1.7.15, varias páginas de Grist renderizadas por el servidor incrustaban valores controlados por el usuario en la página y en scripts en línea sin escaparlos completamente, permitiendo cross-site scripting. En la página principal de la aplicación, el nombre o la descripción de un documento, establecido por un editor de documentos, se renderiza en la página que otros usuarios cargan al abrir el documento. En la página de fin de flujo de OAuth2, el parámetro de solicitud openerOrigin se reflejaba de vuelta en la página servida. El script inyectado se ejecuta en el origen de Grist de la víctima y puede actuar a través de la sesión autenticada, leyendo o modificando datos y cambiando la configuración de uso compartido y las reglas de acceso. Un editor de documentos podría, por lo tanto, escalar a acceso de nivel de propietario. Este problema está solucionado en la versión 1.7.15."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "gristlabs",
          "product": "grist-core",
          "versions": [
            {
              "version": "< 1.7.15",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.3,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-13T16:01:16.076169Z",
          "id": "CVE-2026-55659",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/gristlabs/grist-core/commit/4ced8064b7ea0e1763d5a6a2588b22774ce7efbc",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.15",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-6qrq-h2h6-cw54",
      "source": "[email protected]"
    }
  ]
}