CVE-2024-56357

grist-core is a spreadsheet hosting server. A user visiting a malicious document or submitting a malicious form could have their account compromised, because it was possible to use the javascript: scheme with custom widget URLs and form redirect URLs. This issue has been patched in version 1.3.1...

CVE-2024-56357

creationtimestamp| type| source ---|---|--- 2024-12-20 20:29:37+00:00| seen| https://infosec.exchange/users/cve/statuses/113687040938359325 2024-12-20 21:15:43+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3ldrcmzzy3w2o 2024-12-20 23:26:35+00:00| seen|...

CVE-2024-56357

The vulnerability CVE-2024-56357 affects grist-core prior to version 1.3.1, allowing an attacker to coerce a user into executing JavaScript via the javascript: scheme in custom widget URLs and form redirect URLs. This can lead to user account compromise when a user visits a malicious document or ...

CVE-2024-56357 Cross-site Scripting vulnerability through custom widget URLs and form redirect URLs in grist-core

grist-core is a spreadsheet hosting server. A user visiting a malicious document or submitting a malicious form could have their account compromised, because it was possible to use the javascript: scheme with custom widget URLs and form redirect URLs. This issue has been patched in version 1.3.1...