Loading story…
A critical vulnerability dubbed Cellbreak (CVE-2026-24002, CVSS 9.1) was disclosed in Grist-Core, an open-source relational spreadsheet-database, enabling remote code execution via malicious spreadsheet formulas. The issue is a Pyodide sandbox escape in Grist’s Python formula execution model, allowing attackers to break out of cell-level logic and execute host OS commands or host-runtime JavaScript, potentially exposing filesystem data, secrets, and credentials (e.g., database credentials and API keys) and enabling broader compromise.
The flaw was reported as stemming from insufficient isolation and a bypassable blocklist approach in the Pyodide-based formula engine; exploitation can leverage Python introspection to reach sensitive built-ins (e.g., __builtins__) and invoke system-level functionality (e.g., importing os and calling os.system()), with additional risk noted from accessible modules such as ctypes. The issue was addressed in Grist 1.7.9; mitigations include upgrading and avoiding configurations that weaken isolation (notably the GRIST_PYODIDE_SKIP_DENO setting) when untrusted formulas may be processed, with Grist moving Pyodide formula execution under the Deno JavaScript runtime by default.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers publicly disclosed a critical sandbox-escape vulnerability in Grist-Core, tracked as CVE-2026-24002 and nicknamed 'Cellbreak'. The flaw allows malicious spreadsheet formulas to escape the Pyodide sandbox and achieve remote code execution through multiple paths including Python built-ins, ctypes, and host-side JavaScript execution.
Grist addressed CVE-2026-24002 in version 1.7.9, released on 2026-01-09. The fix changed formula execution so Pyodide runs under the Deno runtime by default, though using the GRIST_PYODIDE_SKIP_DENO setting can weaken the protection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcescworld.com
Open sourcerescana.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers disclosed **critical remote code execution (RCE) vulnerabilities** in popular self-hosted automation/data platforms that rely on sandboxed expression/formula execution. In *n8n*, JFrog researcher **Natan Nehorai** reported **CVE-2026-1470** (CVSS **9.9**), where authenticated users can abuse the platform’s Expression evaluation to **escape the sandbox** and execute arbitrary code with the privileges of the `n8n` process, including via a crafted JavaScript payload in an “Edit Fields” block that can reach Node.js capabilities (e.g., invoking `child_process`). In *Grist-Core*, Cyera Research Labs detailed **CVE-2026-24002** (CVSS **9.1**), dubbed **Cellbreak**, in which a **malicious spreadsheet formula** can break out of the **Pyodide/WASM** sandbox and execute OS commands or host-runtime JavaScript, collapsing the intended boundary between untrusted cell logic and host execution. Mitigations center on upgrading to fixed releases and validating whether affected sandboxing modes are enabled. Grist maintainers said the issue is addressed in **Grist 1.7.9** and advised administrators to check the Admin Panel sandboxing setting: instances using **`gvisor`** are not affected, while those using **`pyodide`** should update. The Grist disclosure also notes the flaw class is similar to prior Pyodide sandbox-escape issues that have impacted other products (including n8n in earlier reporting), reinforcing that **blocklist-style sandboxing approaches** can be brittle when untrusted code is evaluated in environments with access to host runtime primitives.
Jun 29, 2026
Microsoft disclosed **`CVE-2026-62870`**, a high-severity remote code execution vulnerability in **Microsoft Excel** caused by a use-after-free flaw. The bug carries a **CVSS v3.1 score of 8.8** and affects **Microsoft 365 Apps for Enterprise**, **Excel 2016**, **Office 2019**, **Office LTSC 2021**, and **Office LTSC 2024** on both **32-bit** and **x64-based** systems. According to the advisory, an unauthenticated attacker could exploit the flaw over a network by delivering a specially crafted Excel file and executing code in the context of the current user. Microsoft released security updates addressing the issue, and reporting indicates exploitation requires **user interaction** to open the malicious file. Successful compromise could let attackers install malware, steal data, and pivot further into enterprise environments depending on the victim's privileges. At the time of publication, there was **no public exploit** and **no confirmed active exploitation**, and the vulnerability had **not** been added to **CISA's Known Exploited Vulnerabilities catalog**.
Aug 4, 2026
Microsoft published a long series of security advisories for **remote code execution** vulnerabilities affecting core Office components, with the largest concentration in **Excel** and **Word**. The disclosures include Excel flaws such as `CVE-2024-49026`, `CVE-2024-49069`, `CVE-2025-21362`, `CVE-2025-21381`, `CVE-2025-21387`, `CVE-2025-24082`, `CVE-2025-62553`, `CVE-2026-26107`, `CVE-2026-26109`, `CVE-2026-26112`, and `CVE-2026-40359`, alongside Word issues including `CVE-2025-24077`, `CVE-2025-24078`, `CVE-2025-47170`, `CVE-2025-49700`, `CVE-2025-59222`, `CVE-2026-23657`, and `CVE-2026-33095`. Microsoft also listed related RCE bugs in **Microsoft Office** (`CVE-2025-21392`), **PowerPoint** (`CVE-2025-54908`), **Inbox COM Objects (Global Memory)** (`CVE-2025-58730`), and the **Visual Studio Code Python Extension** (`CVE-2025-49714`). One of the few entries with technical detail, **`CVE-2026-40359`**, describes an **Important** Excel use-after-free flaw (`CWE-416`) with a **CVSS 3.1 score of 7.8** that can let an attacker execute code if a user opens a malicious Office file. Microsoft said the bug was **not publicly disclosed**, **not exploited in the wild**, and **less likely** to be exploited at the time of publication, adding that the **Preview Pane is not an attack vector** and that a fix is available. Taken together, the advisories show Microsoft continuing to address document-driven code execution risks across Office products, where successful exploitation generally depends on **user interaction with crafted files** rather than direct network exposure.
Jun 29, 2026