CVE-2026-7299 Details
Description
Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.
A stored cross-site scripting vulnerability has been identified in Appsmith's SQL query editor, specifically in version 1.98. The issue arises because the autocomplete feature does not properly sanitize database object names before displaying them. This flaw allows authenticated developers to inject malicious JavaScript into table or column names. When other workspace members interact with the same datasource and trigger the SQL autocomplete, the injected script executes in their browser sessions. The vulnerability could lead to session hijacking, privilege escalation, or credential theft.
Users should update to Appsmith version 2.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Stuub/Appsmith-1.98-Stored-XSS-Exploit | CISA-ADP | ExploitThird Party Advisory |
| https://www.kb.cert.org/vuls/id/265691 | CVE | PatchThird Party Advisory |
| https://github.com/appsmithorg/appsmith/commit/99d69180919981ed9bc5484050d809a5bec68acc | [email protected] | Patch |
| https://github.com/appsmithorg/appsmith/pull/41666 | [email protected] | Issue TrackingPatchVendor Advisory |
| https://github.com/appsmithorg/appsmith/releases/tag/v2.1 | [email protected] | Release Notes |
| https://github.com/appsmithorg/appsmith/security/advisories/GHSA-vvxf-f8q9-86gh | [email protected] | Vendor Advisory |
| https://github.com/Stuub/Appsmith-1.98-Stored-XSS-Exploit | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| appsmith appsmith | < 1.99 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | Initial Analysis | [email protected] |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | New CVE Received | [email protected] |
| Jun 2, 2026 | CVE Modified | CVE |