CVE-2026-7299

CVSS 6.3 MEDIUMEPSS 0.3%

Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Affected products

Appsmith · Appsmith

public PoCs found — 1

githubgithub.com/Stuub/Appsmith-1.98-Stored-XSS-Exploit★ 2

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/appsmithorg/appsmith/commit/99d69180919981ed9bc5484050d809a5bec68acc https://github.com/appsmithorg/appsmith/pull/41666 https://github.com/appsmithorg/appsmith/releases/tag/v2.1 https://github.com/appsmithorg/appsmith/security/advisories/GHSA-vvxf-f8q9-86gh https://github.com/Stuub/Appsmith-1.98-Stored-XSS-Exploit https://www.kb.cert.org/vuls/id/265691