CVE-2026-7299: XSS
Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict assignment of the Appsmith 'Developer' role to trusted personnel only and limit who can edit or create datasources/queries in workspaces to reduce risk of malicious database object names being introduced.
- Operational
Invalidate existing workspace sessions and require affected users to re-authenticate (force logout) to remove any active session state that could have been impacted by injected XSS.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7299?
The severity of CVE-2026-7299 is medium with a CVSS score of 6.3.
What does CVE-2026-7299 exploit?
CVE-2026-7299 exploits the failure of Appsmith’s SQL query editor’s autocomplete functionality to properly sanitize database object names.
How do I fix CVE-2026-7299?
To fix CVE-2026-7299, ensure that all database object names are sanitized before rendering them in innerHTML.
Who is affected by CVE-2026-7299?
Authenticated Developers using Appsmith are affected by CVE-2026-7299.
What kind of attack does CVE-2026-7299 enable?
CVE-2026-7299 enables persistent cross-site scripting (XSS) attacks that can lead to arbitrary code execution in the sessions of other users.