Grist spreadsheet software uses Python formulas and inadvertently renders user‑supplied values without proper escaping in server‑side templates. When a document name or description is inserted into the HTML, or when the OAuth2 end‑of‑flow page reflects the openerOrigin parameter, the value is embedded directly into a script context, creating a cross‑site scripting vulnerability. An attacker can craft a document or manipulate the OAuth2 parameter so that the victim’s browser executes malicious code under the victim’s Grist identity. This allows the attacker to read, modify, or delete data, to change sharing settings, and to elevate privileges to owner level on affected documents.

The affected product is Grist‑Core by Grist Labs. All releases prior to 1.7.15 in the 1.7 series contain the flaw. The issue is fixed in version 1.7.15 and later releases; deployments using earlier versions must be upgraded.

The CVSS score of 7.7 classifies the vulnerability as high severity. The EPSS score of < 1 % indicates a low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is a malicious or compromised user who can create or edit a document or manipulate the OAuth2 redirect, causing the page to render unsanitized user input. Exploitation would give the attacker the victim’s authenticated session privileges, enabling data exfiltration, modification, and potential privilege escalation within the Grist environment.