PT-2025-12998 · Appsmith · Appsmith

Published 2025-03-26 · Updated 2026-03-09 · CVE-2024-55964

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Appsmith versions prior to 1.52

Description An issue was discovered in Appsmith where an incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. The attacker must be able to access Appsmith, login to it, create a datasource, create a query against that datasource, and execute that query.

Recommendations For versions prior to 1.52, update to version 1.52 or later to resolve the issue. As a temporary workaround, consider restricting access to the PostgreSQL instance and limiting the ability to create and execute queries within Appsmith.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BIT-APPSMITH-2024-55964

CVE-2024-55964

GHSA-M95X-4W54-GC83

Affected Products

Appsmith

References · 11

• https://github.com/appsmithorg/appsmith/security/advisories/GHSA-m95x-4w54-gc83 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-appsmith-2024-55964 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55964 · Security Note
• https://osv.dev/vulnerability/CVE-2024-55964 · Vendor Advisory
• https://t.me/cvedetector/21220 · Telegram Post
• https://twitter.com/CCBalert/status/1907071740116640250 · Twitter Post
• https://twitter.com/cybercronai/status/1905674027101790273 · Twitter Post
• https://t.me/cvetracker/20000 · Telegram Post
• https://twitter.com/dailycve/status/2031116231659380894 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1905080669182603429 · Twitter Post
• https://twitter.com/CVEnew/status/1904995302668435604 · Twitter Post