CVE-2026-55665

Impact

Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, so a javascript: URL could run in a victim's Grist origin on a single click.

On the account-selection page, /welcome/select-account used its next query parameter as the account buttons' link target. A crafted link, delivered directly or through a custom widget pointed at that page, ran script when a signed-in victim clicked an account.

In document tours, the GristDocTour table's Link_URL column became a clickable button. An editor of a shared document could store a javascript: URL there that ran when another user opened the document and clicked the tour link.

Because the script runs in the victim's authenticated session, it can call Grist's APIs as the victim, reading or modifying data and changing sharing settings and access rules. A document editor could therefore escalate to owner-level access.

Patches

Fixed since version 1.7.15. Mitigation was to validate link targets before use. The account-selection next is accepted only if it resolves to a same-origin http(s) URL, and the document-tour Link_URL is passed through link sanitization that rejects the javascript: scheme.

Workarounds

Limit document edit access to trusted users, or deny structure-edit permission to untrusted editors, and restrict edits to the GristDocTour table in documents that contain one. Be cautious clicking /welcome/select-account links from untrusted parties while signed in to Grist.