VulnSocial

CVE-2026-7299Exploit(appsmith / appsmith)

LOWCVSS 5.4 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Prioritize remediation for appsmith appsmith systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.

appsmith CVEsBack to dashboard
3.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • appsmith

Threat summary

  • Public PoC and exploit tooling are both present
  • 1 mentions across 1 observed day

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
appsmith
Products
appsmith

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-06-03: 1PoC Mentioned / Linked · 2026-06-03: 1Exploit Tool / Code · 2026-06-03: 1Technical Details · 2026-06-03: 106-03
Signal classification1 categories
Exploit
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • Clandestine@akaclandestine
    Exploit

    GitHub - Stuub/Appsmith-1.98-Stored-XSS-Exploit: Automating the exploitation of CVE-2026-7299 - Stored XSS via Database Table/Column Names in SQL Autocomplete within Appsmith =>1.99. Initial discovery 30/03/26 · GitHub https://github.com/Stuub/Appsmith-1.98-Stored-XSS-Exploit

    Post summary

    A GitHub repository provides functional code to automate exploitation of CVE-2026-7299, a stored XSS flaw in Appsmith’s SQL autocomplete, but no evidence of live attacks or patch guidance is presented.

    020441.1K
    62.5K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appappsmithappsmith---

Explore more

Back to dashboardappsmith CVEsappsmith vulnerabilities