CVE-2026-7299

Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.

• CWE-79

• https://github.com/Stuub/Appsmith-1.98-Stored-XSS-ExploitExploit, Third Party Advisory
• https://github.com/appsmithorg/appsmith/commit/99d69180919981ed9bc5484050d809a5bec68accPatch
• https://github.com/appsmithorg/appsmith/pull/41666Issue Tracking, Patch, Vendor Advisory
• https://github.com/appsmithorg/appsmith/releases/tag/v2.1Release Notes
• https://github.com/appsmithorg/appsmith/security/advisories/GHSA-vvxf-f8q9-86ghVendor Advisory
• https://www.kb.cert.org/vuls/id/265691Patch, Third Party Advisory
• https://github.com/Stuub/Appsmith-1.98-Stored-XSS-ExploitExploit, Third Party Advisory

Published

Jun 2, 2026

Last Modified

Jul 22, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7293A vulnerability was detected in SourceCodester Pizzafy Ecomm…4.7
• CVE-2026-7294A flaw has been found in SourceCodester Pizzafy Ecommerce Sy…2.4
• CVE-2026-7295A vulnerability has been found in SourceCodester Pizzafy Eco…2.4
• CVE-2026-7296A vulnerability was found in SourceCodester Pizzafy Ecommerc…2.4
• CVE-2026-7297A vulnerability was determined in SourceCodester Pizzafy Eco…2.4
• CVE-2026-72971Improper link resolution before file access ('link following…5.5
• CVE-2026-7300Buffer Copy without Checking Size of Input ('Classic Buffer …6.5
• CVE-2026-7301SGLangs multimodal generation runtime scheduler's ROUTER soc…9.8
• CVE-2026-7302SGLangs multimodal generation runtime is vulnerable to an un…9.1
• CVE-2026-7303A security flaw has been discovered in Xuxueli xxl-job up to…3.7
• CVE-2026-73030unearth through 0.18.2, fixed in commit 6c78164, contains a …8.1
• CVE-2026-73031telegram-search contains a stored cross-site scripting vulne…8.7