Junglewise Threat Intelligence

CVE-2026-7299: Appsmith stored XSS in SQL query editor autocomplete

CVE-2026-7299 · Severity: medium · CVSS 6.3 · Published 2026-06-02

Technologies: Appsmith. Vendors: Appsmith.

Executive brief

Appsmith, a platform for building internal business tools, contains a security vulnerability in its SQL query editor. An attacker with developer-level access can name a database table or column with malicious code. When other team members use the autocomplete feature in the editor, this code executes in their browser, potentially allowing the attacker to steal session information or take over the workspace.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Appsmith versions prior to 2.1. The vulnerability is located in the SQL autocomplete rendering logic within `hintHelpers.ts`, where the application overrides CodeMirror's default safe rendering with a custom callback that uses `innerHTML` to display database metadata. An authenticated attacker with 'Developer' privileges can create a database object (table or column) containing a JavaScript payload. When another user triggers the autocomplete dropdown for that datasource, the payload is rendered as raw HTML and executed in the context of the victim's session. This can lead to session hijacking or unauthorized API actions. The fix involves migrating the renderer to use `textContent` instead of `innerHTML`.

Affected products

  • Appsmith Appsmith versions prior to 2.1

Timeline

  • 2026-03-30: other: Initial discovery of the vulnerability
  • 2026-04-24: patched: Fix committed to Appsmith repository
  • 2026-06-02: disclosed: CVE-2026-7299 published

References

Related threats