CVE-2026-24002
📋 TL;DR
This vulnerability allows arbitrary code execution on Grist servers when using the pyodide sandbox flavor with untrusted spreadsheets. Attackers can run arbitrary processes on the server hosting Grist. Affects Grist deployments where GRIST_SANDBOX_FLAVOR is set to 'pyodide' and users open malicious documents.
💻 Affected Systems
- Grist
📦 What is this software?
Grist Core by Getgrist
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing attackers to execute arbitrary commands, access sensitive data, pivot to other systems, and maintain persistent access.
Likely Case
Server compromise leading to data theft, installation of malware, or use of server resources for malicious activities like cryptocurrency mining.
If Mitigated
No impact if using gvisor sandbox or patched version, as proper sandboxing prevents code execution.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious spreadsheet) but the attack vector is straightforward once the sandbox is misconfigured.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.9 and later
Vendor Advisory: https://github.com/gristlabs/grist-core/security/advisories/GHSA-7xvx-8pf2-pv5g
Restart Required: Yes
Instructions:
1. Update Grist to version 1.7.9 or later. 2. Restart the Grist service. 3. Verify GRIST_SANDBOX_FLAVOR is not set to 'pyodide'.
🔧 Temporary Workarounds
Switch to gvisor sandbox
allChange sandbox flavor from pyodide to gvisor which provides proper isolation
export GRIST_SANDBOX_FLAVOR=gvisor
🧯 If You Can't Patch
- Set GRIST_SANDBOX_FLAVOR environment variable to 'gvisor' instead of 'pyodide'
- Restrict spreadsheet uploads to trusted sources only and implement strict access controls
🔍 How to Verify
Check if Vulnerable:
Check if GRIST_SANDBOX_FLAVOR environment variable is set to 'pyodide' and Grist version is below 1.7.9Check Version:
Check Grist web interface or server logs for version informationVerify Fix Applied:
Verify Grist version is 1.7.9+ and GRIST_SANDBOX_FLAVOR is not set to 'pyodide'📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from Grist service
- Errors related to pyodide sandbox failures
- Multiple spreadsheet uploads from single user
Network Indicators:
- Outbound connections from Grist server to unexpected destinations
- Unusual network traffic patterns from Grist host
SIEM Query:
source="grist.logs" AND ("pyodide" OR "sandbox failure" OR "process execution")