PT-2026-24145 · Appsmith · Appsmith

Drkim-Dev · Publicado 2026-03-09 · Atualizado 2026-03-13 · CVE-2026-30862

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Appsmith versions prior to 1.96

Description Appsmith is a platform used to build admin panels, internal tools, and dashboards. A critical stored cross-site scripting (XSS) issue exists in the Table Widget (TableWidgetV2) due to insufficient HTML sanitization within the React component rendering process. This allows malicious attributes to be inserted into the Document Object Model (DOM). An attacker with a standard user account can exploit the "Invite Users" feature to compel a System Administrator to execute a privileged API endpoint '/api/v1/admin/env', leading to a full administrative account takeover. The issue is caused by a lack of HTML sanitization in the React component rendering pipeline.

Recommendations Update to version 1.96 or later.

Exploit

Correção

LPE

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BIT-APPSMITH-2026-30862

CVE-2026-30862

GHSA-5HW4-WHXV-6794

Produtos afetados

Appsmith

Referências · 10

• 🔥 https://github.com/appsmithorg/appsmith/security/advisories/GHSA-5hw4-whxv-6794 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30862.json · Exploit
• https://twitter.com/TheHackerWire/status/2031430093856452898 · Publicação no Twitter
• https://t.me/CVEtracker/46944 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-30862 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-30862 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-appsmith-2026-30862 · Aviso do Fabricante
• https://twitter.com/0dayPublishing/status/2031137683221700725 · Publicação no Twitter
• https://t.me/cveNotify/155415 · Publicação no Telegram
• https://twitter.com/CveFindCom/status/2031425347225264545 · Publicação no Twitter