CVE-2025-64752

MediumCVSS 6.8

Published: 13/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

In grist-core prior to version 1.7.7, a user with access to any document can use a server-side URL fetching feature. The privileged network access of server-side requests could enable attack escalation.

Risk Assessment

An attacker with document access can use the server as a proxy to reach network resources they normally cannot access, potentially leading to further attacks.

Recommendation

Update grist-core to version 1.7.7 or later. As a workaround, avoid exposing http/https endpoints to a Grist instance that expose credentials or operate without credentials.

Other vulnerabilities in grist-core

CVE-2025-64753Medium
grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or tables to which the user was not supposed to have read access. This was fixed in version 1.7.7 by restricting the /compare endpoint to users with full read access. As a workaround, remove sensitive document history using the /states/remove endpoint. Another possibility is to block the /compare endpoint.

Original NVD description (English source)

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with access to any document on a Grist installation can use a feature for fetching from a URL that is executed on the server. The privileged network access of server-side requests could offer opportunities for attack escalation. This issue is fixed in version 1.7.7. The mitigation was to use the proxy for untrusted fetches intended for such purposes. As a workaround, avoid making http/https endpoints available to an instance running Grist that expose credentials or operate without credentials.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS