Remote Code Execution Vulnerability in Grist by Grist Labs

CVE-2025-64752

What is CVE-2025-64752?

The grist-core application, a server for hosting spreadsheets, is vulnerable to a remote code execution attack when configured with prior versions than 1.7.7. This vulnerability arises when a user gains access to any document within a Grist installation and exploits the URL fetching feature that executes commands on the server. The potential for attack escalation is significant due to the privileged network access granted to these server-side requests. The issue has been successfully mitigated in version 1.7.7, which introduced a proxy feature for untrusted fetches. As a precaution, users are advised to restrict access to HTTP/HTTPS endpoints that could compromise credentials or function without proper authentication.

References