PT-2026-3906 · Pyodide+3 · Pyodide+3

Vladimirelitokarev

·

Published

2026-01-22

·

Updated

2026-02-06

·

CVE-2026-24002

CVSS v3.1
9.6
VectorAV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Grist versions prior to 1.7.9
Description Grist is spreadsheet software that utilizes Python as its formula language. When configured to run formulas in the Pyodide sandbox (
GRIST SANDBOX FLAVOR
set to 
pyodide
), a crafted spreadsheet formula can escape the sandbox and execute arbitrary processes on the host server. This allows an attacker to run operating system commands and potentially access sensitive information like database credentials and API keys. The issue stems from the lack of a robust sandbox barrier within the Pyodide implementation on Node.js.
Recommendations Versions prior to 1.7.9 should be updated to version 1.7.9 or later. As a workaround for versions prior to 1.7.9, set 
GRIST SANDBOX FLAVOR
to 
gvisor
to utilize the gvisor-based sandbox.

Exploit

Fix

RCE

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2026-24002
GHSA-7XVX-8PF2-PV5G

Affected Products

Grist
Deno
Gvisor
Pyodide