La vulnérabilité d'Appsmith SQL Autocomplete permet l'escalade des privilèges via les noms de table malveillants

Authenticated developers can hijack administrator sessions in Appsmith by simply naming a PostgreSQL table or column with a malicious JavaScript payload.

Exploiting the Autocomplete Renderer

Appsmith's SQL query editor relies on CodeMirror to provide autocomplete functionality for developers working with shared datasources. A vulnerability tracked as CVE-2026-7299 exists because the autocomplete engine fails to sanitize database object names before rendering them using innerHTML.

An attacker with developer-level access to a shared PostgreSQL datasource can create malicious database objects—such as tables or columns—whose names contain XSS payloads. When a workspace member, such as an administrator, interacts with that same datasource and triggers the autocomplete function (for example, by typing SELECT * FROM), the stored payload executes immediately in their browser.

From Developer Access to Full Workspace Control

The impact of this vulnerability extends far beyond simple script execution. Because the payload runs in the context of the victim's active session, successful exploitation enables session hijacking, credential theft, and privilege escalation.

In a typical workflow, a low-privileged developer can use this flaw to target an administrator. By triggering the autocomplete mechanism in the administrator's browser, the developer can execute arbitrary code to steal session tokens or perform actions with administrative authority, effectively bypassing the workspace's permission model.

Patching and Remediation

Appsmith has released version 2.1 to address CVE-2026-7299. This update implements proper sanitization of database object names within the autocomplete renderer to prevent innerHTML injection.

Users running Appsmith should update their installations to version 2.1 or later immediately to mitigate the risk of unauthorized privilege escalation within their shared workspaces.

Source: VU#265691: Appsmiths SQL Query autocomplete renderer contains a cross site scripting vulnerability
Domain: kb.cert.org