PT-2026-24145 · Appsmith · Appsmith

Drkim-Dev · Published 2026-03-09 · Updated 2026-03-13 · CVE-2026-30862

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Appsmith versions prior to 1.96

Description Appsmith is a platform used to build admin panels, internal tools, and dashboards. A critical stored cross-site scripting (XSS) issue exists in the Table Widget (TableWidgetV2) due to insufficient HTML sanitization within the React component rendering process. This allows malicious attributes to be inserted into the Document Object Model (DOM). An attacker with a standard user account can exploit the "Invite Users" feature to compel a System Administrator to execute a privileged API endpoint '/api/v1/admin/env', leading to a full administrative account takeover. The issue is caused by a lack of HTML sanitization in the React component rendering pipeline.

Recommendations Update to version 1.96 or later.

Exploit

Fix

LPE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-APPSMITH-2026-30862

CVE-2026-30862

GHSA-5HW4-WHXV-6794

Affected Products

Appsmith

References · 10

• 🔥 https://github.com/appsmithorg/appsmith/security/advisories/GHSA-5hw4-whxv-6794 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30862.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-30862 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30862 · Security Note
• https://osv.dev/vulnerability/BIT-appsmith-2026-30862 · Vendor Advisory
• https://twitter.com/TheHackerWire/status/2031430093856452898 · Twitter Post
• https://t.me/CVEtracker/46944 · Telegram Post
• https://twitter.com/0dayPublishing/status/2031137683221700725 · Twitter Post
• https://t.me/cveNotify/155415 · Telegram Post
• https://twitter.com/CveFindCom/status/2031425347225264545 · Twitter Post