What is the CVSS score of CVE-2026-7299?

CVE-2026-7299 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-7299?

Yes, a public proof-of-concept exploit is available for CVE-2026-7299. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-7299?

Yes, a patch is available for CVE-2026-7299. Update the affected software to the latest version immediately.

Appsmith CVE-2026-7299

EUVD-2026-33936 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-02 certcc

GHSA-6j63-xfwq-f8vj

XSS RCE Appsmith

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jul 22, 2026 - 19:22 NVD

6.3 (MEDIUM) 5.4 (MEDIUM)

Patch available

Jun 02, 2026 - 17:01 EUVD

Source Code Evidence Fetched

Jun 02, 2026 - 16:03 vuln.today

Analysis Generated

Jun 02, 2026 - 16:03 vuln.today

DescriptionNVD

Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.

AnalysisAI

Stored XSS in Appsmith's SQL query editor autocomplete allows an authenticated Developer-role user to inject persistent malicious JavaScript via crafted database table or column names that are rendered unsanitized through innerHTML. When other workspace members interact with the same datasource's query editor, the injected script executes in their browser session, enabling session token theft and unauthorized actions with high confidentiality impact (CVSS C:H). A public proof-of-concept exploit exists (Stuub/Appsmith-1.98-Stored-XSS-Exploit on GitHub), and the vulnerability was reported by CERT/CC, materially elevating practical exploitation risk above what the CVSS 6.3 Medium score alone implies.

Technical ContextAI

The vulnerability resides in Appsmith's SQL query editor autocomplete component, which fetches database schema metadata (table and column names) from connected datasources and renders them into the DOM via innerHTML without HTML entity encoding or output sanitization. This makes innerHTML a dangerous sink for attacker-controlled content sourced from datasource schema. The affected product per CPE string cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:* covers all Appsmith versions. No CWE is formally assigned in the advisory, but the root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS variant), where the malicious payload is written once into datasource metadata and subsequently re-executed for every affected user who triggers autocomplete. Because the payload is persistent server-side, it is not a reflected or DOM-only transient attack - every workspace member sharing that datasource is a potential victim on each subsequent editor interaction.

RemediationAI

Upgrade to Appsmith v2.1 or later, referenced by the GitHub release tag at https://github.com/appsmithorg/appsmith/releases/tag/v2.1 and associated commit https://github.com/appsmithorg/appsmith/commit/99d69180919981ed9bc5484050d809a5bec68acc. The upstream fix is tracked in PR #41666 (https://github.com/appsmithorg/appsmith/pull/41666); consult the security advisory at https://github.com/appsmithorg/appsmith/security/advisories/GHSA-vvxf-f8q9-86gh for vendor-confirmed remediation scope. If immediate patching is not feasible, restrict the Developer role to explicitly trusted internal users as a compensating control, since the attacker must hold at least Developer-level workspace access - this reduces the attack surface but does not eliminate it, as insider-threat scenarios remain. As a detection measure, audit all existing datasource table and column names for embedded HTML tags or script content. Note that the patch version v2.1 is inferred from the GitHub releases reference and has not been independently verified against a vendor changelog.