appsmith
v2.7.0Platform to build admin panels, internal tools, and dashboards. Integrates with 25+ databases and any API.
- Maintenance
- Active369 commits in 3 months · bus factor 11
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 30 advisories3 critical, 16 high, 11 medium · Scorecard 6.7/10
- Supported versions
- No scheduleendoflife.date does not track this project
41.3k stars · 4.8k forks · 4.5k open issues · last release 2 days ago · data checked 43 minutes ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 3 critical, 16 high, 11 medium. Check the patched version against the one you run.
- highGHSA-342c-q2qr-jxrjOct 29, 2026SSRF via incomplete validation of IPv6 transition addresses in HTTP datasources
- Affected
- < 2.4
- Patched in
- 2.4
- highGHSA-x3j2-rfj9-cc32Oct 29, 2026SSRF via inconsistent parsing of leading-zero IP addresses in HTTP datasources
- Affected
- <= 2.4
- Patched in
- 2.4
- highGHSA-4f5q-49pg-g37rOct 28, 2026Unauthorized deploy-key use via missing authorization in Git integration
- Affected
- <= 2.3
- Patched in
- 2.4
- highGHSA-724j-456c-hj36Oct 28, 2026Account takeover via a session isolation bypass in application JavaScript
- Affected
- <= 2.5.0
- Patched in
- 2.5.0
- mediumGHSA-frqc-9x9h-fv9vOct 6, 2026Cross-site scripting via CSS tokens in custom widgets
- Affected
- <= 2.1
- Patched in
- 2.2
- mediumGHSA-cfv8-wh7w-xx73Oct 6, 2026Git auto-commit progress endpoint discloses branch and progress state without checking caller authorization
- Affected
- <= 2.2
- Patched in
- 2.3
- criticalGHSA-fqwc-g9wm-5895Oct 6, 2026Arbitrary file read and write via symlinks in Git import
- Affected
- <= 2.2
- Patched in
- 2.3
- mediumGHSA-rf99-rc2w-vh94Sep 29, 2026MongoDB root credentials exposed via the admin environment settings endpoint
- Affected
- <= 2.3
- Patched in
- 2.4
- highGHSA-93mf-9h52-gfxpSep 17, 2026Datasource credentials exposed via missing authorization in application import
- Affected
- <= 1.99
- Patched in
- 2.0
- highGHSA-h5qf-426x-5mv5Sep 17, 2026Unauthorized workspace membership changes via incomplete authorization checks
- Affected
- <= 2.2
- Patched in
- 2.3
- mediumGHSA-jx7q-3wm7-42cqSep 14, 2026OAuth2 authorization code exposure via an untrusted datasource redirect origin
- Affected
- >= 2.3
- Patched in
- 2.4
- mediumGHSA-vqqh-qmxm-h96jSep 14, 2026Phishing via open redirects in Appsmith authentication flows
- Affected
- <= 1.97
- Patched in
- 1.97
- criticalGHSA-fhgw-q2jf-8fq7Sep 14, 2026Cross-tenant datasource execution via missing authorization in action validation
- Affected
- <= 2.2
- Patched in
- 2.3
- highGHSA-7wfp-6c63-99gqSep 14, 2026REST API SSRF filter disabled by default on non-Docker deployments
- Affected
- <= 2.1
- Patched in
- 2.2
- highGHSA-vqqg-rp36-9c62Sep 14, 2026Cross-site scripting via unsafe HTML rendering in application editor features
- Affected
- <= 2.1
- Patched in
- 2.2
- mediumGHSA-pf2x-82hw-qqwqSep 14, 2026Local Git repository deletion via path traversal in Git connect
- Affected
- <= 1.99
- Patched in
- 2.0
- highGHSA-p37g-mfwx-3r9fSep 14, 2026Hidden datasource access via authorization bypass in application import and fork
- Affected
- < 2.3
- Patched in
- 2.3
- mediumGHSA-9m99-f4xf-j32cSep 14, 2026Library metadata disclosure via missing authorization in custom JavaScript libraries
- Affected
- <= 2.3
- Patched in
- 2.4
- mediumGHSA-3fm2-xr3x-gx4cSep 14, 2026Unpublished theme data exposure via public application theme access
- Affected
- <= 2.2
- Patched in
- 2.3
- highGHSA-qrgm-h8c4-jjf7Sep 7, 2026Rate Limit Bypass via X-Forwarded-For Header Spoofing — Universal Proxy Trust and Client-Controlled Rate Limit Key Enable Unlimited Authentication Attacks
- Affected
- <=2.2
- Patched in
- v2.3
- mediumGHSA-vjfq-fvfc-3vjwSep 2, 2026Stored XSS via Database Table/Column Names in SQL Autocomplete
- Affected
- =< 1.98
- Patched in
- v2.0
- mediumGHSA-xfc5-796c-7hr9Aug 12, 2026Spring Actuator authentication bypass via empty default internal password
- Affected
- <= 2.2
- Patched in
- v2.3
- highGHSA-qhfj-g87x-m39wAug 12, 2026Developer-to-Admin Account Takeover via Internal Redis Session Hijacking
- Affected
- <= 2.1; <= 3.8.1
- Patched in
- v2.2; 3.9.0; 2.2
- highGHSA-m4hv-9p7g-56vmJul 30, 2026Path Traversal
- Affected
- <= 1.91
- Patched in
- v2.0
- mediumGHSA-v6jh-fx3m-7xhwJun 23, 2026Unauthenticated Access to Full OpenAPI Documentation
- Affected
- <= 1.99
- Patched in
- v2.0
- highGHSA-q4p7-j55w-5mjmJun 12, 2026Broken Object-Level Authorization in PUT /api/v1/pages/{pageId}/dependencyMap Allows Unauthorized Cross-Workspace Modification
- Affected
- <= 2.0
- Patched in
- 2.1
- highGHSA-r553-q33m-v7pfJun 12, 2026Git Widget Name Path Traversal Enables Server-Side Arbitrary JSON File Write
- Affected
- <= v2.0
- Patched in
- v2.1
- highCVE-2026-55455Jun 12, 2026SSRF in REST API / GraphQL datasource plugins via insufficient host denylist
- Affected
- <= 2.0
- Patched in
- 2.1
- highCVE-2026-50189Jun 12, 2026RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route
- Affected
- <= v2.0
- Patched in
- v2.1
- criticalCVE-2026-55454Jun 12, 2026Caddy admin API exposed without authentication
- Affected
- <=2.0
- Patched in
- v2.1