CVE-2026-24002

{
  "id": "CVE-2026-24002",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-24002",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-22T12:52:12.413052Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.6,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "gristlabs",
          "product": "grist-core",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.7.9"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-01-22T03:15:47.777",
  "references": [
    {
      "url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-7xvx-8pf2-pv5g",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://support.getgrist.com/self-managed/#how-do-i-sandbox-documents",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Grist is spreadsheet software using Python as its formula language. Grist offers several methods for running those formulas in a sandbox, for cases where the user may be working with untrusted spreadsheets. One such method runs them in pyodide, but pyodide on node does not have a useful sandbox barrier. If a user of Grist sets `GRIST_SANDBOX_FLAVOR` to `pyodide` and opens a malicious document, that document could run arbitrary processes on the server hosting Grist. The problem has been addressed in Grist version 1.7.9 and up, by running pyodide under deno. As a workaround, a user can use the gvisor-based sandbox by setting  `GRIST_SANDBOX_FLAVOR` to `gvisor`."
    },
    {
      "lang": "es",
      "value": "Grist es un software de hoja de cálculo que utiliza Python como su lenguaje de fórmulas. Grist ofrece varios métodos para ejecutar esas fórmulas en un sandbox, para casos en los que el usuario podría estar trabajando con hojas de cálculo no confiables. Uno de esos métodos los ejecuta en pyodide, pero pyodide en node no tiene una barrera de sandbox útil. Si un usuario de Grist establece 'GRIST_SANDBOX_FLAVOR' en 'pyodide' y abre un documento malicioso, ese documento podría ejecutar procesos arbitrarios en el servidor que aloja Grist. El problema se ha abordado en Grist versión 1.7.9 y posteriores, ejecutando pyodide bajo deno. Como solución alternativa, un usuario puede usar el sandbox basado en gvisor estableciendo 'GRIST_SANDBOX_FLAVOR' en 'gvisor'."
    }
  ],
  "lastModified": "2026-06-17T10:22:27.640",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:getgrist:grist-core:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F8A7C5C-5BE0-4EA5-BB48-F038908933ED",
              "versionEndExcluding": "1.7.9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}