CVE-2026-7299

Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.

• CWE-79

• https://github.com/Stuub/Appsmith-1.98-Stored-XSS-ExploitExploit, Third Party Advisory
• https://github.com/appsmithorg/appsmith/commit/99d69180919981ed9bc5484050d809a5bec68accPatch
• https://github.com/appsmithorg/appsmith/pull/41666Issue Tracking, Patch, Vendor Advisory
• https://github.com/appsmithorg/appsmith/releases/tag/v2.1Release Notes
• https://github.com/appsmithorg/appsmith/security/advisories/GHSA-vvxf-f8q9-86ghVendor Advisory
• https://www.kb.cert.org/vuls/id/265691Patch, Third Party Advisory
• https://github.com/Stuub/Appsmith-1.98-Stored-XSS-ExploitExploit, Third Party Advisory

Published

Jun 2, 2026

Last Modified

Jul 22, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72984Access of resource using incompatible type ('type confusion'…8.8
• CVE-2026-72985Heap-based buffer overflow in Windows Volume Shadow Copy all…6.8
• CVE-2026-72986Heap-based buffer overflow in Graphic Fonts allows an unauth…8.8
• CVE-2026-72987Use after free in Windows DNS allows an unauthorized attacke…8.1
• CVE-2026-72988Heap-based buffer overflow in Windows Biometric Service allo…7.8
• CVE-2026-72989Use of uninitialized resource in Windows Failover Cluster al…7.5
• CVE-2026-72990Heap-based buffer overflow in Windows Biometric Service allo…7.8
• CVE-2026-72991Heap-based buffer overflow in Windows Biometric Service allo…7.8
• CVE-2026-72992Heap-based buffer overflow in Windows Biometric Service allo…7.8
• CVE-2026-72993Heap-based buffer overflow in Windows Biometric Service allo…7.8
• CVE-2026-72994Heap-based buffer overflow in Windows Biometric Service allo…7.8
• CVE-2026-72995Heap-based buffer overflow in Windows Biometric Service allo…7.8