Critical Grist-Core Vulnerability Allows RCE Attacks via Spreadsheet Formulas
Summary: A critical flaw in Grist-Core, the open-source self-hosted relational spreadsheet-database, allows remote code execution through a malicious formula; it is tracked as CVE-2026-24002 with a CVSS score of 9.1 and codenamed Cellbreak by Cyera Research Labs. The issue is a Pyodide sandbox escape, the same class of vulnerability that recently affected n8n as CVE-2025-68668 (CVSS 9.9), and it was addressed in version 1.7.9, released on January 9, 2026.
Why it matters: Grist's blocklist-style sandbox let a formula reach Emscripten runtime functions, giving an attacker filesystem access, database credentials and API keys, and lateral movement paths. Instances showing 'pyodide' in the Admin Panel sandboxing section are exposed until updated, and setting GRIST_PYODIDE_SKIP_DENO to '1' brings the risk back.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-68668CVE-2026-24002
- Related