« Back to list

CVE-2026-7299

Status: AnalyzedMedium (5.4)—

Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Appsmith — Appsmith

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-7299",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-7299",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-02T18:17:27.406510Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cret@cert.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 2.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "Appsmith",
          "product": "Appsmith",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.1",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-02T16:16:45.557",
  "references": [
    {
      "url": "https://github.com/Stuub/Appsmith-1.98-Stored-XSS-Exploit",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://github.com/appsmithorg/appsmith/commit/99d69180919981ed9bc5484050d809a5bec68acc",
      "tags": [
        "Patch"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://github.com/appsmithorg/appsmith/pull/41666",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://github.com/appsmithorg/appsmith/releases/tag/v2.1",
      "tags": [
        "Release Notes"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-vvxf-f8q9-86gh",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/265691",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/Stuub/Appsmith-1.98-Stored-XSS-Exploit",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource."
    },
    {
      "lang": "es",
      "value": "La funcionalidad de autocompletado del editor de consultas SQL de Appsmith no logra sanear los nombres de objetos de la base de datos antes de renderizarlos en innerHTML, permitiendo a un desarrollador autenticado inyectar XSS persistente mediante nombres de tablas o columnas maliciosos, desencadenando la ejecución de código arbitrario en las sesiones de otros miembros del espacio de trabajo cuando interactúan con la misma fuente de datos."
    }
  ],
  "lastModified": "2026-07-22T19:10:00.120",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF2CD79F-AE2C-4E6D-9AE2-BBCC3C231A34",
              "versionEndExcluding": "1.99"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}