CVE-2026-24002 is a critical sandbox weakness (CVSS 9.0) in Grist, the spreadsheet tool with Python formulas. If GRIST_SANDBOX_FLAVOR is set to pyodide, a malicious document could run arbitrary processes on the server. Grist 1.7.9 runs pyodide under deno to fix it. The workaround is the gvisor sandbox.
What's affected
Grist (grist-core) before 1.7.9, but only for deployments where the GRIST_SANDBOX_FLAVOR environment variable is set to pyodide. The advisory explains that pyodide on Node does not provide a useful sandbox barrier. Installations that use other sandbox flavors are not described as affected by this issue.
How to check if you're exposed
Look at how your instance is started:
docker inspect <container> --format '{{range .Config.Env}}{{println .}}{{end}}' | grep GRIST_SANDBOX_FLAVOR
Check your compose file, Kubernetes manifests and environment files for the same variable. Then check your image tag against 1.7.9. If the flavor is pyodide and the version is below 1.7.9, you are affected. Exposure is higher if your users can upload or import documents that come from other people.
What to do now
- Upgrade Grist to 1.7.9 or later. The fix runs pyodide under deno, which gives a real sandbox boundary.
- As an alternative or an immediate step, switch GRIST_SANDBOX_FLAVOR to gvisor, as documented in Grist's self-managed guide. Make sure your host supports gvisor first.
- Until then, do not open documents from untrusted sources on an affected instance.
- Run Grist with the least privileges you can: a non-root user, no host mounts you do not need, limited network egress, and no cloud credentials in the environment.
- Check the server for unexpected processes if you opened untrusted documents on a pyodide setup.
Why it matters
Formulas in a spreadsheet are code. A spreadsheet tool that lets users write Python has to run that code somewhere, and the sandbox is the only thing between the document and the host. The record classifies the issue as CWE-74, injection in a downstream component, which fits how the formula engine's output reaches the host.
The advisory is honest about the cause: the runtime was never meant to be a security boundary on Node. When a sandbox is really a convenience layer, treat it as such. The attack complexity is rated high because it needs a specific non-default flavor, which is also why the configuration check above matters more than the version number. The record does not list this CVE as known exploited.
Reading the severity score
The record gives a CVSS base score of 9.0, published 2026-01-22. In the vector, the attacker works over the network, needs no account, and the attack is high in complexity. User interaction is not needed. Impact on confidentiality is high, on integrity high and on availability high.
A base score describes the flaw in general, not your risk. Weigh it against how exposed your instance is and what it can reach. The Gold page for the CVE keeps the score, weakness and references together.
Hardening beyond the patch
A spreadsheet that runs formulas is a code execution service, and the right design assumes some documents are hostile.
Choose the sandbox deliberately. The advisory names two options: pyodide under deno, which the fixed versions use, and the gvisor based sandbox, which is the documented workaround. Read Grist's self-managed guide on sandboxing and pick the one that fits your hosting. gvisor needs support from the host environment, so test it in staging before you rely on it.
Reduce what a sandbox escape could reach. Run the Grist container as a non-root user with a read only root filesystem where possible. Drop Linux capabilities you do not need. Do not mount the Docker socket or host directories. Keep cloud credentials and database passwords out of the container's environment where you can, and use short lived credentials when you cannot. Limit outbound network access so that a compromised process cannot easily send data out or reach internal services.
Control who can bring documents in. If your users can import spreadsheets from outside the company, treat each import as untrusted. A policy that asks for documents from known sources, plus a separate instance for external documents, limits the blast radius.
Add visibility. Log process starts inside the container if your platform supports it, and alert on shells or unexpected binaries. Watch resource use, since unusual CPU or memory spikes after opening a document are a signal worth investigating.
Finally, document the setting. GRIST_SANDBOX_FLAVOR is an environment variable that can quietly differ between environments. Put it in your infrastructure code, add a check in your deployment pipeline that fails if the value is pyodide on a version below 1.7.9, and review it when you upgrade.
Find it across your own code
To see which of your packages are affected, the free in-browser dependency scan at gold.safeguard.sh/scan takes a manifest and lists known vulnerabilities. Reachability analysis then helps you judge whether your code calls the vulnerable path, so you can order the work.
Quick check
I use the default sandbox. Do I need to act?
The advisory ties the issue to the pyodide flavor. Check your configuration, and consider upgrading anyway, since 1.7.9 is the current fix for the sandbox.
What is the quickest mitigation?
Set GRIST_SANDBOX_FLAVOR to gvisor if your environment supports it, which is the workaround named in the advisory.
Sources
Last reviewed: 19 October 2026.
