CVE-2026-24002

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-24002 is a sandbox escape vulnerability in Grist, an open-source spreadsheet software that uses Python as its formula language. The issue affects the pyodide-based sandbox method when running on Node.js, which lacks an effective isolation barrier. This allows malicious Python formulas in untrusted spreadsheets to execute arbitrary processes on the hosting server if the `GRIST_SANDBOX_FLAVOR` environment variable is set to `pyodide`. The vulnerability is rated at CVSS 9.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) and is associated with CWE-74 (Improper Neutralization of Special Elements used in an SQL Command).

An attacker can exploit this vulnerability by crafting a malicious Grist document containing Python formulas that escape the pyodide sandbox. Exploitation requires a Grist user or administrator to configure the server with `GRIST_SANDBOX_FLAVOR=pyodide` and then open the document, enabling network-based attacks with no privileges needed but high complexity due to the need for a targeted document. Successful exploitation grants arbitrary code execution on the server, resulting in high confidentiality, integrity, and availability impacts with a changed scope.

The Grist security advisory (GHSA-7xvx-8pf2-pv5g) and documentation confirm the issue is fixed in Grist version 1.7.9 and later by running pyodide under Deno for improved sandboxing. As a workaround, administrators should set `GRIST_SANDBOX_FLAVOR` to `gvisor` to use the gvisor-based sandbox instead.