CVE-2022-39824
Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute...
Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list widget, e.g., to perform DoS attacks or achieve an information leak.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list widget, e.g., to perform DoS attacks or achieve an information leak.
- Record
CVE-2022-39824- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list widget, e.g., to perform DoS attacks or achieve an information leak.
- Record
CVE-2022-39824- Updated
- 2026-11-02
EUVDEUVD-2022-42269 No score
Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list widget, e.g., to perform DoS attacks or achieve an information leak.
- Record
EUVD-2022-42269- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-grcg-mvxj-m89r
Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute...
Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list widget, e.g., to perform DoS attacks or achieve an information leak.
- Record
GHSA-grcg-mvxj-m89r- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVBIT-appsmith-2022-39824 No score
Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list widget, e.g., to perform DoS attacks or achieve an information leak.
- Record
BIT-appsmith-2022-39824- Updated
- 2026-11-02
OSV No score
Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list widget, e.g., to perform DoS attacks or achieve an information leak.
- Record
CVE-2022-39824- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
appsmithBitnami |
before 1.7.15 | 1.7.15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-39824 is a high vulnerability (CVSS 8.9) in Appsmith, published September 5, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.12%, the 66th percentile. Fixed in appsmith 1.7.15.