Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-24002— pyodide sandbox option is insecure

Quick assessment

Affected
gristlabs grist-core
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Grist是Grist开源的一种现代关系电子表格。 Grist 1.7.9之前版本存在注入漏洞，该漏洞源于pyodide沙箱屏障不足，可能导致在服务器上执行任意进程。

CVSS 9.1 · Critical EPSS 0.52% · P44

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-24002

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
pyodide sandbox option is insecure
Source: CVE Program / CVE List V5
Vulnerability Description
Grist is spreadsheet software using Python as its formula language. Grist offers several methods for running those formulas in a sandbox, for cases where the user may be working with untrusted spreadsheets. One such method runs them in pyodide, but pyodide on node does not have a useful sandbox barrier. If a user of Grist sets `GRIST_SANDBOX_FLAVOR` to `pyodide` and opens a malicious document, that document could run arbitrary processes on the server hosting Grist. The problem has been addressed in Grist version 1.7.9 and up, by running pyodide under deno. As a workaround, a user can use the gvisor-based sandbox by setting `GRIST_SANDBOX_FLAVOR` to `gvisor`.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Grist 注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Grist是Grist开源的一种现代关系电子表格。 Grist 1.7.9之前版本存在注入漏洞，该漏洞源于pyodide沙箱屏障不足，可能导致在服务器上执行任意进程。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

Vendor Product Affected Versions CPE Subscribe
gristlabs grist-core < 1.7.9 -

II. Public POCs for CVE-2026-24002

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-24002

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-24002 (1)

Vendor Pages for CVE-2026-24002 (1)

IV. Related Vulnerabilities

Same product: grist-core
Same vendor: gristlabs
Same weakness: CWE-74