CVE-2026-30862: Appsmith Table Widget XSS Vulnerability

CVE-2026-30862 Overview

CVE-2026-30862 is a critical Stored Cross-Site Scripting (XSS) vulnerability in Appsmith, an open-source platform used to build admin panels, internal tools, and dashboards. The vulnerability exists in the Table Widget (TableWidgetV2) component and stems from a lack of HTML sanitization in the React component rendering pipeline. This allows malicious attributes to be interpolated directly into the DOM.

The attack chain enables a regular user to weaponize the "Invite Users" feature to force a System Administrator to execute a high-privileged API call to /api/v1/admin/env, resulting in full administrative account takeover.

Critical Impact

This vulnerability allows authenticated low-privileged users to escalate privileges and completely take over administrator accounts through a crafted XSS payload, potentially compromising the entire Appsmith deployment and any connected data sources.

Affected Products

• Appsmith versions prior to 1.96
• Appsmith TableWidgetV2 component
• Self-hosted and cloud deployments running vulnerable versions

Discovery Timeline

• 2026-03-10 - CVE-2026-30862 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-30862

Vulnerability Analysis

This Stored XSS vulnerability (CWE-79) occurs in Appsmith's TableWidgetV2 React component. The root cause is the absence of proper HTML sanitization when rendering user-controlled data within the table widget. When the React component renders table content, malicious HTML attributes injected by an attacker are interpolated directly into the DOM without encoding or sanitization.

The attack is particularly dangerous because it leverages social engineering through Appsmith's legitimate "Invite Users" functionality. An attacker with a standard user account can craft a malicious payload that, when viewed by an administrator, automatically triggers privileged API calls on their behalf.

The vulnerability demonstrates a classic privilege escalation through XSS pattern, where the attacker's JavaScript executes in the context of the victim administrator's authenticated session, inheriting their elevated permissions.

Root Cause

The vulnerability stems from inadequate input sanitization in the React component rendering pipeline of the TableWidgetV2 widget. Specifically, user-supplied content is rendered without being passed through an HTML sanitizer, allowing script injection through malicious element attributes. This is a common flaw in React applications that use dangerouslySetInnerHTML or improperly bind user data to element attributes without validation.

Attack Vector

The attack leverages the network-accessible Appsmith platform and requires only low-privilege user authentication. The attacker exploits the "Invite Users" feature as a delivery mechanism:

1. Initial Access: Attacker authenticates with a standard user account
2. Payload Injection: Attacker crafts a malicious XSS payload within table widget data
3. Delivery: Attacker uses the "Invite Users" feature to lure the administrator to view the poisoned content
4. Execution: When the administrator views the table, the stored XSS payload executes in their browser context
5. Privilege Escalation: The payload makes an authenticated request to /api/v1/admin/env using the administrator's session
6. Account Takeover: The attacker gains full administrative control

The vulnerability requires user interaction (administrator must view the malicious content), but this is facilitated through the legitimate collaboration features of the platform. For more technical details, see the GitHub Security Advisory.

Detection Methods for CVE-2026-30862

Indicators of Compromise

• Unexpected API calls to /api/v1/admin/env from user browser sessions
• Unusual JavaScript execution patterns in TableWidgetV2 components
• Administrator account modifications or environment variable changes without corresponding admin activity
• Suspicious table widget content containing encoded JavaScript or event handler attributes

Detection Strategies

• Monitor web application logs for requests to sensitive administrative endpoints (/api/v1/admin/env) that originate from non-administrative user actions
• Implement Content Security Policy (CSP) headers to detect and block inline script execution
• Review audit logs for administrator account changes that don't correlate with legitimate admin sessions
• Deploy Web Application Firewall (WAF) rules to detect XSS payloads in table widget data submissions

Monitoring Recommendations

• Enable detailed logging for all administrative API endpoints
• Configure alerting on environment configuration changes via the admin API
• Monitor for unusual patterns in the "Invite Users" feature usage
• Implement real-time detection for DOM manipulation attempts in client-side telemetry

How to Mitigate CVE-2026-30862

Immediate Actions Required

• Upgrade Appsmith to version 1.96 or later immediately
• Review recent administrator account activity for signs of compromise
• Audit table widget content for suspicious or malicious payloads
• Temporarily restrict the "Invite Users" feature if immediate upgrade is not possible

Patch Information

The vulnerability is fixed in Appsmith version 1.96. The fix implements proper HTML sanitization in the React component rendering pipeline for the TableWidgetV2 widget, preventing malicious attributes from being interpolated into the DOM.

Organizations should upgrade to version 1.96 or later as soon as possible. For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• Implement strict Content Security Policy headers to mitigate XSS impact (script-src 'self')
• Restrict access to the "Invite Users" feature to trusted administrators only
• Deploy network-level controls to limit access to administrative API endpoints
• Consider placing Appsmith behind an authenticating reverse proxy with additional XSS filtering

# Example: Content Security Policy header configuration for nginx
# Add to your Appsmith nginx configuration

add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'self';" always;

# Monitor admin API endpoint access
# Add logging configuration to track suspicious requests
log_format admin_api '$remote_addr - $remote_user [$time_local] "$request" '
                     '$status $body_bytes_sent "$http_referer" '
                     '"$http_user_agent" "$http_x_forwarded_for"';

# Apply to admin API location
location /api/v1/admin/ {
    access_log /var/log/nginx/appsmith_admin_api.log admin_api;
    # existing proxy configuration
}