CVE-2026-7299: Appsmith SQL Query Editor XSS Vulnerability
Summary
CVE-2026-7299: CVE-2026-7299. Affects appsmith versions < 1.99.0. Fixed in 1.99.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Appsmith is an open-source framework that allows developers to build internal tools quickly. It provides a SQL query editor that enables users to interact with databases easily. However, the SQL query editor's autocomplete functionality has a critical vulnerability that fails to sanitize database object names, exposing users to potential security risks.
Vulnerability Detail
The vulnerability arises from the SQL query editor's autocomplete feature, which does not properly sanitize database object names before rendering them in innerHTML. This oversight allows an authenticated Developer to inject persistent Cross-Site Scripting (XSS) attacks through malicious table or column names. When other workspace members interact with the same datasource, their sessions can be compromised, leading to arbitrary code execution and potential data breaches.
How To Fix
Minimum fixed version
1.99.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using potentially malicious table or column names in your database until the package can be updated. Additionally, limit access to the SQL query editor to trusted developers only.
Conclusion
CVE-2026-7299 represents a significant security risk in Appsmith's SQL query editor due to its failure to sanitize database object names. Users are encouraged to update to the latest version to protect against potential XSS attacks and ensure the security of their applications.
See every vulnerability recorded for appsmith →
FAQ
CVE-2026-7299 is a vulnerability in Appsmith's SQL query editor that allows for persistent XSS attacks due to improper sanitization of database object names.
Authenticated Developers using Appsmith's SQL query editor are at risk, as well as any workspace members interacting with compromised datasources.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to arbitrary code execution in the sessions of other users, potentially compromising sensitive data and application integrity.
Yes, a patch is available in version 1.99.0 of Appsmith. It is crucial to update to this version or later to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for appsmith.
