CVE-2024-56357

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-56357
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56357.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-56357
Aliases
  • GHSA-cq5q-cqr7-vmf6
Published
2024-12-20T20:24:51.149Z
Modified
2025-12-05T07:35:50.229666Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Cross-site Scripting vulnerability through custom widget URLs and form redirect URLs in grist-core
Details

grist-core is a spreadsheet hosting server. A user visiting a malicious document or submitting a malicious form could have their account compromised, because it was possible to use the javascript: scheme with custom widget URLs and form redirect URLs. This issue has been patched in version 1.3.1. Users are advised to upgrade. Users unable to upgrade should avoid visiting documents or forms prepared by people they do not trust.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56357.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/gristlabs/grist-core

Affected ranges

Type
GIT
Repo
https://github.com/gristlabs/grist-core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8453a020d5f46a63cea5d1a7e42b60a9aca223cf

Affected versions

v0.*

v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.7.8
v0.7.9

v1.*

v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.12
v1.1.13
v1.1.14
v1.1.15
v1.1.16
v1.1.17
v1.1.18
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v1.2.0
v1.2.1
v1.3.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56357.json"