High severity8.1NVD Advisory· Published Dec 20, 2024· Updated Jun 17, 2026

CVE-2024-56357

Description

grist-core is a spreadsheet hosting server. A user visiting a malicious document or submitting a malicious form could have their account compromised, because it was possible to use the javascript: scheme with custom widget URLs and form redirect URLs. This issue has been patched in version 1.3.1. Users are advised to upgrade. Users unable to upgrade should avoid visiting documents or forms prepared by people they do not trust.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Gristlabs/Grist Corev52 versions
< 1.3.1+ 1 more
- (no CPE)range: < 1.3.1
- (no CPE)range: <1.3.1
Getgrist/Grist Core
cpe:2.3:a:getgrist:grist-core:*:*:*:*:*:*:*:*
Range: <1.3.1

Patches

Vulnerability mechanics

References

github.com/gristlabs/grist-core/commit/10b069005ec8d5f511e6554a56111d8f257f029envdPatch
github.com/gristlabs/grist-core/security/advisories/GHSA-cq5q-cqr7-vmf6nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000