The vulnerability allows an attacker to inject an unsanitized javascript URL that is executed within the victim’s authenticated session. Because the code runs with the victim’s privileges, the attacker can call Grist APIs to read, modify, or delete data and change sharing settings, effectively elevating from an editor to an owner of the document.

Grist Core versions earlier than 1.7.15 are affected. The flaw appears in the account-selection page where the next query parameter becomes a link target, and in document tours where the GristDocTour table’s Link_URL column turns into a clickable button. Users of Grist Core before the 1.7.15 release are therefore at risk; platform details are not specified.

The CVSS score of 8.5 indicates a high severity. The EPSS score of < 1% implies a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, but the complexity of exploitation is low for a user with access to the document tour or account selection pages. An attacker only needs to inject a malicious javascript URL into a shared document or influence a user’s account selection; no remote network access is required. Once the victim clicks the link, the attacker’s code runs with full authenticated privileges, potentially leading to large‑scale data exfiltration or authority abuse.