Appsmith Table Widget Stored XSS to Admin Account Takeover — CVE-2026-30862

Metadata

Affected Target

Summary

Appsmith’s TableWidgetV2 component (BasicCell.tsx) fails to sanitize user-supplied cell values when the column type is URL or Plain Text, rendering raw HTML/attributes directly as React children and allowing stored XSS. Because Appsmith’s XSRF-TOKEN cookie is readable via document.cookie (unlike the HttpOnly-protected session cookie), a regular user can combine the stored XSS with the app’s built-in “Invite” sharing feature to deliver the payload to a System Administrator. When the admin opens the shared app, the injected script reads their XSRF token and issues an authenticated PUT /api/v1/admin/env request that adds the attacker’s own account to the administrative email whitelist, resulting in full admin account takeover.

Vulnerability Details

Root Cause

BasicCell.tsx returns unsanitized user-controlled values (URL/Plain Text column types) as raw content in the DOM rendering sink, and the app’s XSRF token is accessible to any script running in the page context via document.cookie.

Attack Vector

1. Log in as a regular user (user@gmail.com) and create a new application with a Table Widget.
2. Set the Table Data property to a JSON payload containing an onerror-triggering <img> tag in a URL/Plain Text column to confirm XSS execution (alert(document.domain)).
3. Replace the payload with a weaponized version that reads document.cookie for the XSRF-TOKEN and issues a fetch('/api/v1/admin/env', {method:'PUT', ...}) request adding the attacker’s email to APPSMITH_ADMIN_EMAILS.
4. Use Appsmith’s “Share”/“Invite” feature to invite the System Administrator (admin@gmail.com) to the malicious application.
5. When the Administrator opens the invited app, the Table Widget renders and executes the injected script in their authenticated session, silently granting the attacker’s account administrative privileges.

Impact

A low-privileged authenticated user can escalate to full System Administrator privileges over the entire Appsmith instance by weaponizing stored XSS delivered through the platform’s own sharing/invite feature.

Environment / Lab Setup

Target:   Appsmith <= 1.95, multi-user instance with an existing System Administrator account
Attacker: A standard registered Appsmith user account and a web browser

Proof of Concept

PoC Script

See CVE-2026-30862_POC/Step 1.json and CVE-2026-30862_POC/Step 2.json in this folder.

Step 1.json contains the confirmation payload (onerror alert). Step 2.json contains the weaponized payload that reads the victim’s XSRF token and calls /api/v1/admin/env to add the attacker’s account to the admin whitelist once the invited administrator views the table.

Detection & Indicators of Compromise

Signs of compromise:

• Unexpected additions to APPSMITH_ADMIN_EMAILS not performed via the intended admin settings UI
• Table Widget data containing <img onerror=...> or similar HTML injection patterns
• Admin account activity correlated with opening applications shared by low-privileged users

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/drkim-dev/CVE-2026-30862 on 2026-07-05.