What is the CVSS score of CVE-2026-30862?

CVE-2026-30862 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Appsmith are affected by CVE-2026-30862?

A critical stored cross-site scripting (XSS) vulnerability in Appsmith versions prior to 1.96 allows attackers to inject malicious code into Table Widget components that executes when accessed by…

How to fix or mitigate CVE-2026-30862?

Within 24 hours: Audit all Appsmith instances to identify version numbers and inventory Table Widget usage in production dashboards. Within 7 days: Implement compensating controls (disable TableWidgetV2 where feasible, apply WAF rules to block XSS payloads, restrict Appsmith access to trusted networks only). Within 30 days: Upgrade all Appsmith instances to version 1.96 or later once patch is released and tested in staging environment.

Appsmith CVE-2026-30862

CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-03-10 security-advisories@github.com

XSS Appsmith

9.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 17:40 nvd

CRITICAL 9.0

DescriptionGitHub Advisory

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipeline, allowing malicious attributes to be interpolated into the DOM. By leveraging the "Invite Users" feature, an attacker with a regular user account (user@gmail.com) can force a System Administrator to execute a high-privileged API call (/api/v1/admin/env), resulting in a Full Administrative Account Takeover. This vulnerability is fixed in 1.96.