PT-2026-45788 · Appsmith · Appsmith

Published 2026-06-02 · Updated 2026-06-02 · CVE-2026-7299

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Appsmith versions prior to 2.1

Description The SQL query editor's autocomplete functionality fails to sanitize database object names before rendering them in innerHTML. This allows an authenticated Developer with access to a shared PostgreSQL datasource to inject persistent Cross-Site Scripting (XSS) by creating malicious table or column names. When other workspace members interact with the same datasource and trigger the autocomplete feature, the unsanitized names lead to arbitrary JavaScript execution in their sessions, which can result in session hijacking, privilege escalation, or credential theft.

Recommendations Update to version 2.1.

Exploit

Fix

Related Identifiers

CVE-2026-7299

Affected Products

Appsmith

References · 8

• 🔥 https://github.com/Stuub/Appsmith-1.98-Stored-XSS-Exploit · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7299 · Security Note
• https://github.com/appsmithorg/appsmith/releases/tag/v2.1 · Note
• https://github.com/appsmithorg/appsmith/security/advisories/GHSA-vvxf-f8q9-86gh · Note
• https://github.com/appsmithorg/appsmith/commit/99d69180919981ed9bc5484050d809a5bec68acc · Note
• https://kb.cert.org/vuls/id/265691 · Note
• https://github.com/appsmithorg/appsmith/pull/41666 · Note
• https://reddit.com/r/SecOpsDaily/comments/1tuts2t/vu265691_appsmiths_sql_query_autocomplete · Reddit Post