CVE-2026-24002

Grist is spreadsheet software using Python as its formula language. Grist offers several methods for running those formulas in a sandbox, for cases where the user may be working with untrusted spreadsheets. One such method runs them in pyodide, but pyodide on node does not have a useful sandbox barrier. If a user of Grist sets `GRIST_SANDBOX_FLAVOR` to `pyodide` and opens a malicious document, that document could run arbitrary processes on the server hosting Grist. The problem has been addressed in Grist version 1.7.9 and up, by running pyodide under deno. As a workaround, a user can use the gvisor-based sandbox by setting `GRIST_SANDBOX_FLAVOR` to `gvisor`.

Affected products

Grist, Deno, Gvisor, Pyodide

Getgrist Grist-core

< 1.7.9

Fix

Available

CVSS 3.1

9.6 CRITICAL

EPSS

0.5% (41th percentile)

Weakness

CWE-74

NVD status

Analyzed

Published

2026-01-22

No exploit for CVE-2026-24002 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.