CVE-2026-7299

MEDIUM EPSS 25.9%
Published Jun 2, 20264w ago · Modified Jun 17, 20262w ago
5.4 CVSS 3.1
Medium
Find Similar
Published Jun 2, 2026 4w ago
Last Modified Jun 17, 2026 2w ago

Description

Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.

CVSS Details

Base Score
5.4
Exploitability
2.3
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
25.9% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
appsmithappsmith* <1.99

References 6

  • github.com https://github.com/Stuub/Appsmith-1.98-Stored-XSS-Exploit
    ExploitThird Party Advisory
  • github.com https://github.com/appsmithorg/appsmith/commit/99d69180919981ed9bc5484050d809a5bec68acc
    Patch
  • github.com https://github.com/appsmithorg/appsmith/pull/41666
    Issue TrackingPatchVendor Advisory
  • github.com https://github.com/appsmithorg/appsmith/releases/tag/v2.1
    Release Notes
  • github.com https://github.com/appsmithorg/appsmith/security/advisories/GHSA-vvxf-f8q9-86gh
    Vendor Advisory
  • kb.cert.org https://www.kb.cert.org/vuls/id/265691
    PatchThird Party Advisory

Remediation

  • github.com https://github.com/appsmithorg/appsmith/commit/99d69180919981ed9bc5484050d809a5bec68acc
    Patch
  • github.com https://github.com/appsmithorg/appsmith/pull/41666
    Issue TrackingPatchVendor Advisory
  • kb.cert.org https://www.kb.cert.org/vuls/id/265691
    PatchThird Party Advisory