Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-24002: Grist can run malicious code on server via pyodide

CVE-2026-24002 · published 9 months ago

Summary

Grist spreadsheet software lets users run Python formulas in a sandbox. If the sandbox is set to use pyodide, a crafted spreadsheet could start any program on the Grist server. Upgrade to Grist 1.7.9 or later, or switch the sandbox setting to the gvisor option, to prevent this.

What to do

Update getgrist grist-core to version 1.7.9 or later.

Affected software

Vendor	Product	Affected versions
getgrist	grist-core	< 1.7.9 `cpe:2.3:a:getgrist:grist-core::::::::`

Original advisory text

pyodide sandbox option is insecure

Grist is spreadsheet software using Python as its formula language. Grist offers several methods for running those formulas in a sandbox, for cases where the user may be working with untrusted spreadsheets. One such method runs them in pyodide, but pyodide on node does not have a useful sandbox barrier. If a user of Grist sets `GRIST_SANDBOX_FLAVOR` to `pyodide` and opens a malicious document, that document could run arbitrary processes on the server hosting Grist. The problem has been addressed in Grist version 1.7.9 and up, by running pyodide under deno. As a workaround, a user can use the gvisor-based sandbox by setting `GRIST_SANDBOX_FLAVOR` to `gvisor`.

References

https://support.getgrist.com/self-managed/#how-do-i-sandbox-documents URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24002... Vendor Advisory
https://github.com/gristlabs/grist-core/security/advisories/GHSA-7xvx-8pf2-pv5g Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-24002 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.0 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-74Injection

Timeline

Published22 Jan 2026

Updated4 Nov 2026

First seen6 Mar 2026

Sources

CVE-2026-24002 · NVD

CVE-2026-24002 · OSV

GHSA-7xvx-8pf2-pv5g · GHSA

Track software like this

Free during beta