CVE-2026-7299

6.3 MEDIUM

Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allo...

Published: 2026-06-02 · Last updated: 2026-06-04

Severity and scoring

CVSS: 6.3 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
CWE: CWE-79

Affected products

Vendor	Product
appsmith	appsmith

Description

Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-7299
[Exploit reference]https://github.com/Stuub/Appsmith-1.98-Stored-XSS-Exploit
[Patch]https://github.com/appsmithorg/appsmith/commit/99d69180919981ed9bc5484050d809a5bec68acc
[Patch]https://github.com/appsmithorg/appsmith/pull/41666
[Other]https://github.com/appsmithorg/appsmith/releases/tag/v2.1
[Vendor advisory]https://github.com/appsmithorg/appsmith/security/advisories/GHSA-vvxf-f8q9-86gh
[Patch]https://www.kb.cert.org/vuls/id/265691
[Exploit reference]https://github.com/Stuub/Appsmith-1.98-Stored-XSS-Exploit

Related CVEs

Same CWE

CVE-2026-9125 — The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_url' parameter of the [presto_player_ov... (6.4 MEDIUM)
CVE-2026-42653 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.Mihai SliceWP allows Stored XSS (7.1 HIGH)
CVE-2026-46489 — SolidInvoice is an open-source invoicing platform (8.1 HIGH)
CVE-2026-8589 — GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0... (7.3 HIGH)
CVE-2026-10087 — GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2... (8.7 HIGH)