Stuub/Appsmith-1.98-Stored-XSS-Exploit
PoC files
2 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
Python script that automates exploitation of CVE-2026-7299, a stored XSS vulnerability in Appsmith 1.98. The script authenticates to an Appsmith instance, creates a workspace and application, connects to a PostgreSQL datasource, and injects a malicious table name containing an XSS payload via a CREATE TABLE statement. The payload executes in other users' browsers when SQL autocomplete renders the table name via innerHTML.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python exploit script for CVE-2026-7299, a stored XSS vulnerability in Appsmith. The script automates the documented exploit flow: authenticating to Appsmith, creating a workspace, connecting to a PostgreSQL datasource, and injecting an XSS payload via a CREATE TABLE statement. No concealed backdoor, unrelated remote access, persistence mechanism, or deceptive payload targeting the PoC operator was observed. The script's behavior is fully consistent with the stated vulnerability exploitation.
Classification basis and observed behavior
Classification basis
The artifact is a fully automated Python script that exercises the CVE-2026-7299 vulnerability by authenticating, creating a malicious database table with an XSS payload, and triggering the vulnerable autocomplete rendering path. It performs the complete exploit chain from initial access to payload delivery, not merely detecting or reporting the vulnerability.
exploit.py:1-4exploit.py:361-399exploit.py:472-502Requirements
- Valid Appsmith user credentials with Developer role
exploit.py:122-152 - Network access to a target Appsmith instance
exploit.py:511-512 - A writable PostgreSQL datasource connected to the Appsmith instance, or credentials to create one
exploit.py:205-230exploit.py:268-297
Observed behavior
- Authenticates to the Appsmith instance using provided email and password
exploit.py:122-152 - Creates a new workspace and application, or reuses existing ones
exploit.py:155-202 - Locates an existing writable PostgreSQL datasource or auto-discovers one by testing common connection parameters
exploit.py:205-230exploit.py:268-297 - Creates a new datasource if none is found, using provided or discovered PostgreSQL credentials
exploit.py:312-359 - Creates a query action containing a CREATE TABLE statement with the XSS payload as the table name
exploit.py:361-399 - Executes the query action to create the malicious table in the database
exploit.py:401-447 - Refreshes the datasource structure to load the poisoned table name into the autocomplete cache
exploit.py:450-470 - Outputs success message indicating the XSS payload will fire when another workspace member triggers SQL autocomplete
exploit.py:494-502
Behaviors behind the backdoor verdict
Observables
- Xss Payload
- <img src=x onerror=alert(document.domain)>Default XSS payload used to demonstrate the stored XSS vulnerability.
exploit.py:98 - Sql Injection
- CREATE TABLE "{xss_payload}" (id serial primary key);SQL statement used to inject the XSS payload as a table name into the PostgreSQL database.
exploit.py:365 - Network Request
- POST /api/v1/actions/executeAPI endpoint used to execute the malicious SQL query against the Appsmith instance.
exploit.py:425-427 - Credential Usage
- Attacker email and password passed via command-line argumentsCredentials are used only for authentication to the target Appsmith instance as part of the exploit.
exploit.py:511-516
What the analysis did not establish
- Evidence does not include execution output or verification that the script successfully exploited a live target.
- The README.md references a screenshot and video demo that are not included in the evidence packets.
- Only the two text files (README.md and exploit.py) were reviewed; no binary files were present or analyzed.
- The review does not assess the safety or correctness of the exploit against any specific Appsmith instance.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.