CVE-2024-56358 - CVE House
Back to Database
Status published High CVE-2024-56358

Cross-site Scripting vulnerability through svg attachment previews in grist-core

Vulnerability Description

grist-core is a spreadsheet hosting server. A user visiting a malicious document and previewing an attachment could have their account compromised, because JavaScript in an SVG file would be evaluated in the context of their current page. This issue has been patched in version 1.3.2. Users are advised to upgrade. Users unable to upgrade should avoid previewing attachments in documents prepared by people they do not trust.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-56358

Credits & Attribution

No credits recorded in the NVD database.

References

More from gristlabs

View All →
CVE-2025-64753
grist-core has insufficient access control in endpoints for comparisons between documents and versions
Medium 5.3
CVE-2025-64752
grist-core has path to server-side requests via websocket
Medium 6.8
CVE-2024-56359
Cross-site Scripting vulnerability through HyperLink cells in grist-core
High 8.1
CVE-2024-56357
Cross-site Scripting vulnerability through custom widget URLs and form redirect URLs in grist-core
High 8.1

Affected Vendor

Affected Software

grist-core
Vulnerable Versions:
< 1.3.2

Timeline

Official Publish: December 20th, 2024
Last Modified: December 24th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact