CVE-2026-7299
Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary…
Does this matter?
Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own.
Description
Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.34% probability · 27th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- appsmith/appsmith
- Source
- cret@cert.org
References
- https://github.com/Stuub/Appsmith-1.98-Stored-XSS-ExploitExploit, Third Party Advisory
- https://github.com/appsmithorg/appsmith/commit/99d69180919981ed9bc5484050d809a5bec68accPatch
- https://github.com/appsmithorg/appsmith/pull/41666Issue Tracking, Patch, Vendor Advisory
- https://github.com/appsmithorg/appsmith/releases/tag/v2.1Release Notes
- https://github.com/appsmithorg/appsmith/security/advisories/GHSA-vvxf-f8q9-86ghVendor Advisory
- https://www.kb.cert.org/vuls/id/265691Patch, Third Party Advisory
- https://github.com/Stuub/Appsmith-1.98-Stored-XSS-ExploitExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.