Vulnerability Description
Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Appsmith | Appsmith | < 1.99 |
Related Weaknesses (CWE)
References
- https://github.com/Stuub/Appsmith-1.98-Stored-XSS-ExploitExploitThird Party Advisory
- https://github.com/appsmithorg/appsmith/commit/99d69180919981ed9bc5484050d809a5bPatch
- https://github.com/appsmithorg/appsmith/pull/41666Issue TrackingPatchVendor Advisory
- https://github.com/appsmithorg/appsmith/releases/tag/v2.1Release Notes
- https://github.com/appsmithorg/appsmith/security/advisories/GHSA-vvxf-f8q9-86ghVendor Advisory
- https://www.kb.cert.org/vuls/id/265691PatchThird Party Advisory
- https://github.com/Stuub/Appsmith-1.98-Stored-XSS-ExploitExploitThird Party Advisory
FAQ
What is CVE-2026-7299?
CVE-2026-7299 is a vulnerability with a CVSS score of 6.3 (MEDIUM). Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a m...
How severe is CVE-2026-7299?
CVE-2026-7299 has been rated MEDIUM with a CVSS base score of 6.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-7299?
Check the references section above for vendor advisories and patch information. Affected products include: Appsmith Appsmith.