CVE-2026-30862 Critical Stored XSS & Privilege Escalation in Appsmith
Stored XSS in Appsmith allows attackers to escalate privileges and take over admin accounts via malicious table widget inputs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-30862?
CVE-2026-30862 is a critical cross-site scripting vulnerability in appsmithorg appsmith, published on 9 Mar 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipeline, allowing malicious attributes to be interpolated into the DOM. By leveraging the "Invite Users" feature, an attacker with a regular user account ([email protected]) can force a System Administrator to execute a high-privileged API call (/api/v1/admin/env), resulting in a Full Administrative Account Takeover. This vulnerability is fixed in 1.96.
Weakness: CWE-79
Which versions are affected by CVE-2026-30862?
1 open source package ship an affected version, including appsmith. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
appsmith Bitnami | All versions | 1.96.0 |
Products include Appsmith Appsmith.
How do I fix CVE-2026-30862?
Upgrade appsmith to 1.96.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-30862 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30862 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in appsmithorg appsmith
- CVE-2026-55454 Appsmith: Caddy admin API exposed without authentication
- CVE-2024-55964 Code injection in n/a
- CVE-2026-22794 Account Takeover Vulnerability in Appsmith
- CVE-2026-24042 Appsmith public apps can execute unpublished actions (viewMode confusion)
- CVE-2026-50189 Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route
Sources
Also known as BIT-appsmith-2026-30862, GHSA-5hw4-whxv-6794.