CVE-2026-7299

MediumCVSS 5.4/10Last modified Jul 22, 2026

Description

Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 2, 2026
Last modified
Jul 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-729907.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-729917.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-729927.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-729937.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-729947.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-729957.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-729967.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-729977.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-729996.8Out-of-bounds read in Windows USB Hub Driver allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-73006.5Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Web Integration Service) aCVE-2026-730007.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-730017.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
CVE-2026-7299: Medium severity, CVSS 5.4 | Vulnix