Vulnerability · Published Jun 2, 2026 · Assigned by certcc
CVE-2026-7299CVE-2026-7299
Medium 6.3
In plain English
A medium-severity security flaw in Appsmith from Appsmith. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.3%top 72.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.
Affected products (as reported)
References
- https://github.com/appsmithorg/appsmith/security/advisories/GHSA-vvxf-f8q9-86gh
- https://github.com/appsmithorg/appsmith/pull/41666
- https://github.com/Stuub/Appsmith-1.98-Stored-XSS-Exploit
- https://github.com/appsmithorg/appsmith/releases/tag/v2.1
- https://github.com/appsmithorg/appsmith/commit/99d69180919981ed9bc5484050d809a5bec68acc
- https://www.kb.cert.org/vuls/id/265691