{"id":"BIT-appsmith-2026-7299","summary":"CVE-2026-7299","details":"Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.","aliases":["BIT-appsmith-2026-49979","CVE-2026-49979","CVE-2026-7299","GHSA-vvxf-f8q9-86gh"],"modified":"2026-09-10T16:01:08.176495240Z","published":"2026-06-05T08:42:17.288Z","database_specific":{"cpes":["cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*"],"severity":"Medium"},"references":[{"type":"ADVISORY","url":"https://github.com/Stuub/Appsmith-1.98-Stored-XSS-Exploit"},{"type":"FIX","url":"https://github.com/appsmithorg/appsmith/commit/99d69180919981ed9bc5484050d809a5bec68acc"},{"type":"ADVISORY","url":"https://github.com/appsmithorg/appsmith/pull/41666"},{"type":"ARTICLE","url":"https://github.com/appsmithorg/appsmith/releases/tag/v2.1"},{"type":"ADVISORY","url":"https://github.com/appsmithorg/appsmith/security/advisories/GHSA-vvxf-f8q9-86gh"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7299"},{"type":"ADVISORY","url":"https://www.kb.cert.org/vuls/id/265691"}],"affected":[{"package":{"name":"appsmith","ecosystem":"Bitnami","purl":"pkg:bitnami/appsmith"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.99.0"}]}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/appsmith/BIT-appsmith-2026-7299.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N"}]}],"schema_version":"1.9.0"}