CVE-2026-24002: Getgrist Grist-core RCE Vulnerability

CVE-2026-24002 Overview

CVE-2026-24002 is a sandbox escape vulnerability in Grist, an open-source spreadsheet application that uses Python as its formula language. Grist supports multiple sandbox flavors for executing formulas from untrusted documents. When the GRIST_SANDBOX_FLAVOR environment variable is set to pyodide, formulas run inside Pyodide on Node.js, which does not enforce a meaningful sandbox boundary. An attacker who convinces a Grist user to open a malicious document can execute arbitrary processes on the host server. The flaw is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Grist version 1.7.9 resolves the issue by running Pyodide under Deno.

Critical Impact
A malicious Grist document can break out of the Pyodide sandbox and execute arbitrary OS commands on the server, leading to full compromise of the Grist host.

Affected Products

getgrist/grist-core versions prior to 1.7.9
Self-managed Grist deployments configured with GRIST_SANDBOX_FLAVOR=pyodide
Any Grist instance hosting documents from untrusted users under the affected sandbox flavor

Discovery Timeline

2026-01-22 - CVE-2026-24002 published to the National Vulnerability Database
2026-02-17 - Last updated in NVD database

Technical Details for CVE-2026-24002

Vulnerability Analysis

Grist evaluates spreadsheet formulas written in Python. To isolate untrusted code, the application offers several sandbox backends selectable through the GRIST_SANDBOX_FLAVOR environment variable, including gvisor, pyodide, and others. Pyodide is a CPython port compiled to WebAssembly. When executed inside a browser, the browser provides the isolation boundary. When executed under Node.js, however, Pyodide inherits the privileges of the Node.js process and can invoke Node APIs.

Grist's Pyodide-on-Node configuration did not introduce an additional isolation layer. A formula author could reach Node.js globals from within the WebAssembly runtime and use them to spawn child processes, read files, or open network connections. The fix in version 1.7.9 reroutes Pyodide execution through Deno, which enforces permission-based isolation at the runtime level.

Root Cause

The root cause is a missing isolation boundary between the Pyodide WebAssembly environment and the host Node.js process. Pyodide on Node.js exposes JavaScript interoperability that resolves to the host's globals, including require, process, and child_process. Grist treated Pyodide as an isolating sandbox without verifying that the runtime actually restricted host access.

Attack Vector

Exploitation requires user interaction. An attacker crafts a Grist document containing a malicious Python formula and shares it with a target user. When the user opens the document on a server configured with GRIST_SANDBOX_FLAVOR=pyodide, the formula executes and pivots from Python to JavaScript through Pyodide's interop layer. The formula then invokes Node.js child-process APIs to run arbitrary commands under the Grist service account. Because the scope is changed (S:C in the CVSS vector), impact extends beyond the sandbox to the entire host.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-7xvx-8pf2-pv5g for vendor technical details.

Detection Methods for CVE-2026-24002

Indicators of Compromise

Unexpected child processes spawned by the Grist Node.js process, especially shells (sh, bash), interpreters (python, perl), or network utilities (curl, wget, nc)
Outbound network connections from the Grist host to unfamiliar IPs or domains shortly after a new document is opened
New or modified files in the Grist data directory or in user-writable paths outside expected document storage
Grist log entries showing formula evaluation errors followed by anomalous process activity

Detection Strategies

Inspect the running configuration for GRIST_SANDBOX_FLAVOR=pyodide on any host running grist-core older than 1.7.9
Monitor process trees rooted at the Grist Node.js process and alert on any execution of system binaries
Apply file integrity monitoring to the Grist installation directory and document store
Correlate document upload or open events with subsequent process creation on the host

Monitoring Recommendations

Enable audit logging (auditd on Linux) for execve calls made by the Grist service user
Forward Grist application logs and host process telemetry to a central SIEM for correlation
Track egress network flows from Grist servers and baseline expected destinations

How to Mitigate CVE-2026-24002

Immediate Actions Required

Upgrade grist-core to version 1.7.9 or later, which runs Pyodide under Deno with enforced permissions
If immediate upgrade is not possible, change GRIST_SANDBOX_FLAVOR from pyodide to gvisor and restart the Grist service
Audit existing documents for untrusted Python formulas and restrict document sharing until the patch is applied
Rotate any credentials, API tokens, or secrets accessible from the Grist host if compromise is suspected

Patch Information

Grist version 1.7.9 addresses the vulnerability by executing Pyodide inside Deno, which provides runtime permission controls that block host process and filesystem access by default. Refer to the GitHub Security Advisory and the Grist sandbox documentation for upgrade and configuration guidance.

Workarounds

Switch to the gVisor-based sandbox by setting GRIST_SANDBOX_FLAVOR=gvisor, which provides a user-space kernel boundary between formulas and the host
Restrict Grist to trusted users only and disable upload of externally sourced documents until the patch is deployed
Run the Grist service under a dedicated low-privilege account with no access to other application data on the host

bash

# Configuration example: switch sandbox flavor and restart Grist
export GRIST_SANDBOX_FLAVOR=gvisor
systemctl restart grist

# Verify the active sandbox flavor
systemctl show grist --property=Environment | grep GRIST_SANDBOX_FLAVOR