Appsmith: Stored XSS and Privilege Escalation (CVE-2026-30862)

CVE-2026-30862 describes a critical stored cross-site scripting (XSS) vulnerability in Appsmith versions 1.95 and earlier. The vulnerability exists within the Table Widget component (TableWidgetV2), specifically in BasicCell.tsx, where raw user-supplied data is rendered without sanitization. An attacker with a regular user account can exploit this to execute malicious JavaScript in the context of a System Administrator's session, leading to full administrative account takeover.

Attack Chain

1. Attacker creates an application and adds a Table Widget.
2. Attacker injects a malicious XSS payload into the Table Data property.
3. Attacker uses the "Share" feature to invite an administrative user to the application.
4. The administrator clicks the invitation and views the malicious table.
5. The XSS payload executes in the administrator's browser session.
6. The payload extracts the administrator's XSRF-TOKEN from document.cookie.
7. The payload sends a malicious PUT request to administrative API endpoints (e.g., /api/v1/admin/env) to add the attacker's account to the administrative whitelist.
8. The attacker authenticates as the upgraded account, gaining full administrative control over the instance.

Impact

Successful exploitation results in full administrative takeover of the Appsmith instance. This allows attackers to access sensitive environment variables, database credentials, and modify any application within the instance.

Recommendation

1. Upgrade all Appsmith instances to version 1.96 or later immediately.
2. Implement a strict Content Security Policy (CSP) that includes a restricted connect-src directive to prevent unauthorized API calls from browser-side scripts.
3. Audit existing application Table Widgets for anomalous scripts or payload-like structures in data properties.