Stored XSS Vulnerability in Appsmith Platform's Table Widget
CVE-2026-30862

9.1CRITICAL

Key Information:

Vendor

Appsmithorg

Status
Appsmith
Vendor
CVE Published:
9 March 2026

What is CVE-2026-30862?

The Appsmith platform, a solution for building admin panels and internal tools, contains a Stored XSS vulnerability in its Table Widget (TableWidgetV2) prior to version 1.96. This vulnerability arises from inadequate HTML sanitization in the rendering pipeline of the React component, enabling attackers to inject malicious attributes into the DOM. By exploiting the 'Invite Users' functionality, an attacker with a standard user account can compel a System Administrator to execute high-privilege API calls, leading to a complete takeover of the administrative account. This issue has been resolved in version 1.96.

Affected Version(s)

appsmith < 1.96

References

https://github.com/appsmithorg/appsmith/security/advisori...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.