CVE-2026-7299

Katalog CVE

CVSS 5.4 · Medium EPSS 0,43%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada appsmith. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.

Rincian

Terbit di NVD

2 Juni 2026

Terakhir diubah

22 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/appsmithorg/appsmith/pull/41666 issue tracking · patch · advisory vendor
• https://github.com/appsmithorg/appsmith/security/advisories/GHSA-vvxf-f8q9-86gh advisory vendor
• https://github.com/appsmithorg/appsmith/commit/99d69180919981ed9bc5484050d809a5bec68acc patch
• https://www.kb.cert.org/vuls/id/265691 patch · advisory pihak ketiga
• https://github.com/Stuub/Appsmith-1.98-Stored-XSS-Exploit exploit · advisory pihak ketiga
• https://github.com/appsmithorg/appsmith/releases/tag/v2.1 release notes