4 matches found
CVE-2024-56358
grist-core is a spreadsheet hosting server. A user visiting a malicious document and previewing an attachment could have their account compromised, because JavaScript in an SVG file would be evaluated in the context of their current page. This issue has been patched in version 1.3.2. Users are...
CVE-2024-56358 Cross-site Scripting vulnerability through svg attachment previews in grist-core
grist-core is a spreadsheet hosting server. A user visiting a malicious document and previewing an attachment could have their account compromised, because JavaScript in an SVG file would be evaluated in the context of their current page. This issue has been patched in version 1.3.2. Users are...
CVE-2024-56358
CVE-2024-56358 affects Grist Core prior to 1.3.2. The vulnerability is a cross-site scripting (XSS) condition where previewing an SVG-embedded JavaScript in a malicious document is executed in the user’s page context, potentially compromising the user’s account. Affected component: grist-core ser...
CVE-2024-56358 Cross-site Scripting vulnerability through svg attachment previews in grist-core
grist-core is a spreadsheet hosting server. A user visiting a malicious document and previewing an attachment could have their account compromised, because JavaScript in an SVG file would be evaluated in the context of their current page. This issue has been patched in version 1.3.2. Users are...