Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

com.appsmith:interfaces

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.2MavenPublished

    appsmith has SQL Injection in FilterDataService via Unsafe DROP TABLE Execution

    GHSA-h8cj-hpmg-636v

    Affected
    • Maven com.appsmith:interfaces <= 1.98
    Fixed in
    1.99· Vendor fix available
    Issue
    A SQL injection vulnerability exists in FilterDataServiceCE.java where the dropTable method constructs a SQL DROP TABLE statement using string concatenation with the table name. If the table name is derived from user input, this allows for arbitrary SQL command execution. Details The vulnerability is located in app/server/appsmith-interfaces/src/main/java/com/appsmith/external/services/ce/FilterDataServiceCE.java. Line 627 in dropTable method: The tableName argument is concatenated directly into the SQL string without validation or escaping. PoC If dropTable is exposed to user input (e.g., via a utility API that accepts a table name to clean up), an attacker could provide a value like: validtable; DROP TABLE users; -- The resulting query would be: DROP TABLE validtable; DROP TABLE users; --; This would delete the intended table and then delete the users table (or execute any other injected SQL). Impact Type: SQL Injection Impact: Data Loss (Drop Table), potentially Data…

    Recommended action: Upgrade to 1.99 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →