grist-core
v1.7.22Grist is the evolution of spreadsheets.
- Maintenance
- Active300 commits in 3 months · bus factor 4
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 10 advisories2 critical, 5 high, 3 medium
- Supported versions
- No scheduleendoflife.date does not track this project
12.1k stars · 683 forks · 733 open issues · last release 17 days ago · data checked 4 hours ago
Security advisories
All advisories on GitHubThe 10 most recent advisories published by the maintainers: 2 critical, 5 high, 3 medium. Check the patched version against the one you run.
- criticalGHSA-9x4j-4rw5-3vmqSep 13, 2026RCE through prototype pollution from an imported crafted document
- Affected
- < 1.7.19
- Patched in
- 1.7.19
- mediumCVE-2026-55664Jun 19, 2026Insufficient access control in the /forms endpoint exposes table metadata
- Affected
- < 1.7.15
- Patched in
- 1.7.15
- highCVE-2026-55665Jun 19, 2026DOM-based XSS in Grist via unsanitized links, enabling privilege escalation
- Affected
- < 1.7.15
- Patched in
- 1.7.15
- highCVE-2026-55659Jun 17, 2026XSS through unsafe value interpolation in server-rendered pages
- Affected
- < 1.7.15
- Patched in
- 1.7.15
- criticalCVE-2026-24002Jan 21, 2026pyodide sandbox option is insecure
- Affected
- < 1.7.9
- Patched in
- 1.7.9
- mediumCVE-2025-64752Nov 13, 2025Path to server-side requests via websocket
- Affected
- < 1.7.6
- Patched in
- 1.7.6
- mediumCVE-2025-64753Nov 13, 2025Insufficient access control in endpoints for comparisons between documents and versions
- Affected
- < 1.7.6
- Patched in
- 1.7.6
- highCVE-2024-56359Dec 20, 2024XSS vulnerability through HyperLink cells
- Affected
- < 1.3.2
- Patched in
- 1.3.2
- highCVE-2024-56358Dec 20, 2024XSS vulnerability through svg attachment previews
- Affected
- < 1.3.2
- Patched in
- 1.3.2
- highCVE-2024-56357Dec 20, 2024XSS vulnerability through custom widget URLs and form redirect URLs
- Affected
- < 1.3.1
- Patched in
- 1.3.1