PT-2025-46916 · Unknown · Grist-Core

Published 2025-11-13 · Updated 2025-11-14 · CVE-2025-64752

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions grist-core versions prior to 1.7.7

Description grist-core is a spreadsheet hosting server. A user with access to any document on a Grist installation can use a feature for fetching from a URL that is executed on the server. The privileged network access of server-side requests could offer opportunities for attack escalation. As a workaround, avoid making http/https endpoints available to an instance running Grist that expose credentials or operate without credentials.

Recommendations Update to version 1.7.7 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-64752

GHSA-QH95-2QV8-PQX3

Affected Products

Grist-Core

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64752.json · Exploit
• https://github.com/gristlabs/grist-core/security/advisories/GHSA-qh95-2qv8-pqx3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64752 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64752 · Vendor Advisory
• https://github.com/gristlabs/grist-core/releases/tag/v1.7.7 · Note
• https://t.me/cveNotify/142750 · Telegram Post
• https://t.me/CVEtracker/37300 · Telegram Post
• https://twitter.com/CVEnew/status/1989194844548526197 · Twitter Post