Appsmith CVE-2026-7299

The attacker must hold at minimum a Developer role within the target Appsmith workspace, confirmed by the CVSS PR:L (low privilege required) indicator - unauthenticated exploitation is not possible. The victim must actively interact with the SQL query editor's autocomplete feature while connected to the compromised datasource, satisfying CVSS UI:R (user interaction required). The datasource must be shared across workspace members so that victims have access to and interact with the poisoned schema. Workspace members who never open the SQL query editor against that specific datasource are not exposed. No non-default Appsmith configuration is required beyond a standard shared SQL datasource. Exploitation is constrained to the Appsmith application's browser security context (S:U - unchanged scope), meaning the injected script cannot directly access other browser origins. Limiting factors for defenders: revoke or restrict Developer role assignment; audit datasource schema object names for injection payloads; monitor for unexpected outbound requests from the Appsmith frontend.

The CVSS 6.3 (Medium) vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N accurately captures the network-reachable, low-complexity nature of the attack while acknowledging the two limiting factors: the attacker requires low-privilege (Developer) access (PR:L), and a victim must interact with the poisoned autocomplete (UI:R). The High confidentiality impact (C:H) is well-founded given the ability to steal active session tokens and exfiltrate workspace data across all affected users. No EPSS score was provided in the intelligence input, so exploitation probability cannot be quantified from that signal. This CVE is not confirmed in the CISA KEV catalog based on available data. However, the public PoC exploit substantially elevates real-world exploitation likelihood above the raw CVSS score - stored XSS with a working exploit and low-privilege entry point is operationally higher priority than a reflected XSS at the same score. The 'RCE' tag in the intelligence data is imprecise: the actual impact is browser-context JavaScript execution (session hijacking, credential theft, UI manipulation), not server-side remote code execution - defenders should scope their incident response accordingly. SSVC signals: exploitation status is 'PoC publicly available' (not confirmed in-the-wild), automatable once Developer access is obtained, technical impact is partial (browser session scope, not full system compromise).

An attacker with Appsmith Developer role access connects a SQL datasource and renames a table or column to a JavaScript payload such as an image tag with an onerror handler that beacons the victim's session cookie to an attacker-controlled endpoint. When any other workspace member opens the SQL query editor and types in the query window - triggering autocomplete for that datasource - the browser renders the malicious object name via innerHTML, silently executing the payload and exfiltrating the victim's active session token. A public proof-of-concept targeting Appsmith 1.98 is available at https://github.com/Stuub/Appsmith-1.98-Stored-XSS-Exploit, significantly lowering the technical barrier and enabling exploitation by less-skilled attackers.