High severity · published Sep 5, 2022
CVE-2022-39824
Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list…
8.9
CVSS
1.1%
EPSS
No
On KEV
Description
Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list widget, e.g., to perform DoS attacks or achieve an information leak.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
Low
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Appsmith · Appsmith
through 1.7.14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39824
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39824
Exploit
https://github.com/FCncdn/Appsmith-Js-Injection-POC
Release Notes
https://github.com/appsmithorg/appsmith/releases
More from Appsmith
9.9
CVE-2026-55454
Appsmith: Caddy admin API exposed without authentication
9.8
CVE-2026-24042
Appsmith public apps can execute unpublished actions (viewMode confusion)
9.8
CVE-2024-55964
An issue was discovered in Appsmith before 1.52
9.1
CVE-2026-55455
Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist
9.0
CVE-2026-30862
Critical Stored XSS & Privilege Escalation in Appsmith