PT-2026-45788 · Appsmith · Appsmith

Vasco0X4 · CVE-2026-7299 · Published 2026-06-02 · Updated 2026-06-30

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Appsmith versions prior to 2.1

Description The SQL query editor's autocomplete functionality fails to sanitize database object names before rendering them using innerHTML. This allows an authenticated Developer with access to a shared PostgreSQL datasource to inject persistent Cross-Site Scripting (XSS) by creating malicious table or column names. When other workspace members interact with the same datasource and trigger the autocomplete feature, the unsanitized names execute arbitrary JavaScript in their sessions, potentially leading to session hijacking, privilege escalation, or credential theft.

Recommendations Update to version 2.1.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-APPSMITH-2026-49979

BIT-APPSMITH-2026-7299

CVE-2026-7299

GHSA-VVXF-F8Q9-86GH

Affected Products

Appsmith

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7299.json · Exploit
• 🔥 https://github.com/Stuub/Appsmith-1.98-Stored-XSS-Exploit · Exploit
• https://github.com/appsmithorg/appsmith/security/advisories/GHSA-vvxf-f8q9-86gh · Vendor Advisory
• https://github.com/appsmithorg/appsmith/commit/99d69180919981ed9bc5484050d809a5bec68acc · Patch
• https://github.com/appsmithorg/appsmith/pull/41666 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-7299 · Vendor Advisory
• https://kb.cert.org/vuls/id/265691 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7299 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-49979 · Security Note
• https://osv.dev/vulnerability/BIT-appsmith-2026-7299 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-appsmith-2026-49979 · Vendor Advisory
• https://github.com/appsmithorg/appsmith/releases/tag/v2.1 · Note
• https://twitter.com/akaclandestine/status/2062110722750861590 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1tuts2t/vu265691_appsmiths_sql_query_autocomplete · Reddit Post
• https://t.me/CVEtracker/55626 · Telegram Post