CVE-2026-7299 CVE-2026-7299
Authenticated developers can inject persistent XSS via malicious database object names, leading to arbitrary code execution in other users' sessions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-7299?
CVE-2026-7299 is a medium-severity cross-site scripting vulnerability in Appsmith, published on 2 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.
Weakness: CWE-79
Which versions are affected by CVE-2026-7299?
It affects 1 product.
Products include Appsmith Appsmith.
How do I fix CVE-2026-7299?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-7299 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-7299 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Appsmith
- CVE-2026-55454 Appsmith: Caddy admin API exposed without authentication
- CVE-2024-55964 Code injection in n/a
- CVE-2026-22794 Account Takeover Vulnerability in Appsmith
- CVE-2026-24042 Appsmith public apps can execute unpublished actions (viewMode confusion)
- CVE-2026-30862 Critical Stored XSS & Privilege Escalation in Appsmith
Sources
Also known as GHSA-6j63-xfwq-f8vj.