{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aappsmithappsmith/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9,"id":"CVE-2026-30862"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Appsmith (\u003c 1.96)"],"_cs_severities":["critical"],"_cs_tags":["web-application","xss","privilege-escalation","appsmith"],"_cs_type":"advisory","_cs_vendors":["Appsmith"],"content_html":"\u003cp\u003eCVE-2026-30862 describes a critical stored cross-site scripting (XSS) vulnerability in Appsmith versions 1.95 and earlier. The vulnerability exists within the Table Widget component (\u003ccode\u003eTableWidgetV2\u003c/code\u003e), specifically in \u003ccode\u003eBasicCell.tsx\u003c/code\u003e, where raw user-supplied data is rendered without sanitization. An attacker with a regular user account can exploit this to execute malicious JavaScript in the context of a System Administrator's session, leading to full administrative account takeover.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker creates an application and adds a Table Widget.\u003c/li\u003e\n\u003cli\u003eAttacker injects a malicious XSS payload into the Table Data property.\u003c/li\u003e\n\u003cli\u003eAttacker uses the \u0026quot;Share\u0026quot; feature to invite an administrative user to the application.\u003c/li\u003e\n\u003cli\u003eThe administrator clicks the invitation and views the malicious table.\u003c/li\u003e\n\u003cli\u003eThe XSS payload executes in the administrator's browser session.\u003c/li\u003e\n\u003cli\u003eThe payload extracts the administrator's \u003ccode\u003eXSRF-TOKEN\u003c/code\u003e from \u003ccode\u003edocument.cookie\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe payload sends a malicious \u003ccode\u003ePUT\u003c/code\u003e request to administrative API endpoints (e.g., \u003ccode\u003e/api/v1/admin/env\u003c/code\u003e) to add the attacker's account to the administrative whitelist.\u003c/li\u003e\n\u003cli\u003eThe attacker authenticates as the upgraded account, gaining full administrative control over the instance.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative takeover of the Appsmith instance. This allows attackers to access sensitive environment variables, database credentials, and modify any application within the instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all Appsmith instances to version 1.96 or later immediately.\u003c/li\u003e\n\u003cli\u003eImplement a strict Content Security Policy (CSP) that includes a restricted \u003ccode\u003econnect-src\u003c/code\u003e directive to prevent unauthorized API calls from browser-side scripts.\u003c/li\u003e\n\u003cli\u003eAudit existing application Table Widgets for anomalous scripts or payload-like structures in data properties.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-24T03:03:56Z","date_published":"2026-10-24T03:03:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-appsmith-xss-cve-2026-30862/","summary":"Appsmith versions 1.95 and earlier are vulnerable to a stored XSS in the Table Widget component, allowing an authenticated attacker to perform administrative account takeover via session-based privilege escalation.","title":"Appsmith: Stored XSS and Privilege Escalation (CVE-2026-30862)","url":"https://feed.craftedsignal.io/briefs/2026-10-appsmith-xss-cve-2026-30862/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}