Appsmith
CVE-2026-30862
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious XSS payload in TableWidgetV2
-
DeliveryInject via Invite Users feature
-
ExploitAdmin clicks link triggering XSS
-
ExecutionExecute /api/v1/admin/env call
-
ImpactAchieve full account takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires valid user account on Appsmith instance (PR:L). Attacker must craft payload in Table Widget and send invitation to System Administrator who must interact with malicious link (UI:R). Appsmith versions prior to 1.96 without HTML sanitization in TableWidgetV2 React component. |
| Impact | CVSS 9.0 — Appsmith builds internal tools. Stored XSS can steal admin sessions and access all connected datasources. |
| Exploit ScenarioDerived | An attacker injects XSS into an Appsmith application that steals admin session tokens when viewed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Appsmith platform prior to version 1.96 has a critical stored XSS enabling account takeover through crafted admin panel content.
Earlier versions of this analysis (1)
Stored XSS in Appsmith enables admin account takeover.
RemediationAI
Update Appsmith.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Appsmith < 1.96 has a CWE-79 stored XSS. Second Appsmith vulnerability (after CVE-2026-24042 missing auth).
Know when Appsmith gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipeline, allowing malicious attributes to be interpolated into the DOM. By leveraging the "Invite Users" feature, an attacker with a regular user account (user@gmail.com) can force a System Administrator to execute a high-privileged API call (/api/v1/admin/env), resulting in a Full Administrative Account Takeover. This vulnerability is fixed in 1.96.
Executive ViewAI
A critical stored cross-site scripting (XSS) vulnerability in Appsmith versions prior to 1.96 allows attackers to inject malicious code into Table Widget components that executes when accessed by other users. Organizations using Appsmith for internal tools and dashboards face immediate risk of data theft, session hijacking, and lateral movement within their infrastructure.
Until patch availability: (1) Disable TableWidgetV2 feature in Appsmith configuration if business logic permits; (2) Implement Web Application Firewall (WAF) rules to detect and block common XSS patterns in HTTP requests to Appsmith; (3) Restrict network access to Appsmith to internal IP ranges and require multi-factor authentication; (4) Monitor and log all Table Widget creation/modification activities; (5) Conduct security awareness training on reporting suspicious dashboard behavior; (6) Consider temporary migration of critical dashboards to alternative platforms until patch is deployed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)GitHub Advisory
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Appsmith before 1.93 allows attackers to control the Origin header value used as the base URL in password reset and emai
Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code
AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to
Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2. Rated medium severity (CVSS
Reverse-proxy takeover in Appsmith versions prior to 2.1 lets an authenticated low-privileged user abuse server-side req
Server-side request forgery (SSRF) in Appsmith Dashboard component allows unauthenticated remote attackers to manipulate
Appsmith platform version 1.94 and below has a missing authorization vulnerability that allows unauthenticated access to
Stored XSS in Appsmith's SQL query editor autocomplete allows an authenticated Developer-role user to inject persistent
Authenticated command execution in Appsmith versions prior to 2.1 lets any administrator run arbitrary OS commands insid
Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via re
Appsmith versions prior to 1.98 allow unauthenticated remote attackers to access sensitive instance management API endpo
Exploit-DB