Medium severity6.3NVD Advisory· Published Jun 2, 2026· Updated Jun 4, 2026
CVE-2026-7299
CVE-2026-7299
Description
Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*range: <1.99
- (no CPE)
Patches
Vulnerability mechanics
References
5- github.com/appsmithorg/appsmith/commit/99d69180919981ed9bc5484050d809a5bec68accnvdPatch
- github.com/appsmithorg/appsmith/pull/41666nvdIssue TrackingPatchVendor Advisory
- www.kb.cert.org/vuls/id/265691nvdPatchThird Party Advisory
- github.com/appsmithorg/appsmith/security/advisories/GHSA-vvxf-f8q9-86ghnvdVendor Advisory
- github.com/appsmithorg/appsmith/releases/tag/v2.1nvdRelease Notes
News mentions
1- ⚡ Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and MoreThe Hacker News · Jun 8, 2026