CVE-2026-30862 Details
Description
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipeline, allowing malicious attributes to be interpolated into the DOM. By leveraging the "Invite Users" feature, an attacker with a regular user account ([email protected]) can force a System Administrator to execute a high-privileged API call (/api/v1/admin/env), resulting in a Full Administrative Account Takeover. This vulnerability is fixed in 1.96.
A critical stored cross-site scripting vulnerability has been identified in the Appsmith Table Widget (TableWidgetV2) in versions prior to 1.96. The issue arises from inadequate HTML sanitization in the React component rendering pipeline, which allows malicious attributes to be injected into the DOM. An attacker with a regular user account can exploit this vulnerability by using the 'Invite Users' feature to manipulate a System Administrator into executing a high-privileged API call, resulting in a full administrative account takeover.
Users are advised to update to Appsmith version 1.96 or later. Additionally, implement proper sanitization of dynamic outputs in the Table Widget and related components, and establish a strict content security policy to prevent unauthorized API calls from XSS payloads.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/appsmithorg/appsmith/security/advisories/GHSA-5hw4-whxv-6794 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/appsmithorg/appsmith/security/advisories/GHSA-5hw4-whxv-6794 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| appsmith appsmith | < 1.96 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 13, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | New CVE Received | [email protected] |