PatchTheCVECVE-2026-24002: Grist is spreadsheet software using Python as its formula language
CVE-2026-24002 is a critical-severity flaw (CVSS 9.0) affecting grist-core. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Grist is spreadsheet software using Python as its formula language. Grist offers several methods for running those formulas in a sandbox, for cases where the user may be working with untrusted spreadsheets. One such method runs them in pyodide, but pyodide on node does not have a useful sandbox barrier. If a user of Grist sets `GRIST_SANDBOX_FLAVOR` to `pyodide` and opens a malicious document, that document could run arbitrary processes on the se
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.0 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 56%) |
| CISA exploited list | No |
| Weakness | CWE-74 |
| Published | 2026-01-22 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-24002?
grist-core: upgrade to 1.7.9. Exact commands for each OS are on this page.
Is CVE-2026-24002 being exploited?
CVE-2026-24002 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-24002 affect?
CVE-2026-24002 affects grist-core. Severity is critical (CVSS 9.0). Grist is spreadsheet software using Python as its formula language. Grist offers several methods for running those formulas in a sandbox, for cases where the user may be working with untrusted spreadsheets. One such method runs them in pyod
How urgent is CVE-2026-24002?
Priority 48/100. Critical severity; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2025-64752 MEDIUM 6.8 UPGRADE grist-core is a spreadsheet hosting server
- CVE-2025-64753 MEDIUM 5.3 UPGRADE grist-core is a spreadsheet hosting server
- CVE-2024-56359 HIGH 8.1 UPGRADE grist-core is a spreadsheet hosting server
- CVE-2024-56358 HIGH 8.1 UPGRADE grist-core is a spreadsheet hosting server
- CVE-2024-56357 HIGH 8.1 UPGRADE grist-core is a spreadsheet hosting server