GHSA-h8cj-hpmg-636v
appsmith has SQL Injection in FilterDataService via Unsafe DROP TABLE Execution
GHSA-h8cj-hpmg-636v is a high vulnerability (CVSS 7.2) in com.appsmith:interfaces, published April 29, 2026. No source lists public exploit code. Fixed in com.appsmith:interfaces 1.99.
- Severity
- 7.2 HighCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.99com.appsmith:interfaces +1 more
Description
Summary
A SQL injection vulnerability exists in FilterDataServiceCE.java where the dropTable method constructs a SQL DROP TABLE statement using string concatenation with the table name. If the table name is derived from user input, this allows for arbitrary SQL command execution.
Details
The vulnerability is located in app/server/appsmith-interfaces/src/main/java/com/appsmith/external/services/ce/FilterDataServiceCE.java.
Line 627 in dropTable method:
public void dropTable(String tableName) {
String dropTableQuery = "DROP TABLE " + tableName + ";";
executeDbQuery(dropTableQuery);
}
The tableName argument is concatenated directly into the SQL string without validation or escaping.
PoC
If dropTable is exposed to user input (e.g., via a utility API that accepts a table name to clean up), an attacker could provide a value like:
valid_table; DROP TABLE users; --
The resulting query would be:
DROP TABLE valid_table; DROP TABLE users; --;
This would delete the intended table and then delete the users table (or execute any other injected SQL).
Impact
- Type: SQL Injection
- Impact: Data Loss (Drop Table), potentially Data Exfiltration or Modification depending on database permissions.
- Who is impacted: Appsmith server instances.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.appsmith:interfacesMaven | through 1.98 | 1.99 |
com.appsmith:interfacesMaven | before 1.99 | 1.99 |
What each source reports
GitHub Advisories Score used
appsmith has SQL Injection in FilterDataService via Unsafe DROP TABLE Execution
Summary
A SQL injection vulnerability exists in FilterDataServiceCE.java where the dropTable method constructs a SQL DROP TABLE statement using string concatenation with the table name. If the table name is derived from user input, this allows for arbitrary SQL command execution.
Details
The vulnerability is located in app/server/appsmith-interfaces/src/main/java/com/appsmith/external/services/ce/FilterDataServiceCE.java.
Line 627 in dropTable method:
public void dropTable(String tableName) {
String dropTableQuery = "DROP TABLE " + tableName + ";";
executeDbQuery(dropTableQuery);
}
The tableName argument is concatenated directly into the SQL string without validation or escaping.
PoC
If dropTable is exposed to user input (e.g., via a utility API that accepts a table name to clean up), an attacker could provide a value like:
valid_table; DROP TABLE users; --
The resulting query would be:
DROP TABLE valid_table; DROP TABLE users; --;
This would delete the intended table and then delete the users table (or execute any other injected SQL).
Impact
- Type: SQL Injection
- Impact: Data Loss (Drop Table), potentially Data Exfiltration or Modification depending on database permissions.
- Who is impacted: Appsmith server instances.
- Record
GHSA-h8cj-hpmg-636v- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
appsmith has SQL Injection in FilterDataService via Unsafe DROP TABLE Execution
Summary
A SQL injection vulnerability exists in FilterDataServiceCE.java where the dropTable method constructs a SQL DROP TABLE statement using string concatenation with the table name. If the table name is derived from user input, this allows for arbitrary SQL command execution.
Details
The vulnerability is located in app/server/appsmith-interfaces/src/main/java/com/appsmith/external/services/ce/FilterDataServiceCE.java.
Line 627 in dropTable method:
public void dropTable(String tableName) {
String dropTableQuery = "DROP TABLE " + tableName + ";";
executeDbQuery(dropTableQuery);
}
The tableName argument is concatenated directly into the SQL string without validation or escaping.
PoC
If dropTable is exposed to user input (e.g., via a utility API that accepts a table name to clean up), an attacker could provide a value like:
valid_table; DROP TABLE users; --
The resulting query would be:
DROP TABLE valid_table; DROP TABLE users; --;
This would delete the intended table and then delete the users table (or execute any other injected SQL).
Impact
- Type: SQL Injection
- Impact: Data Loss (Drop Table), potentially Data Exfiltration or Modification depending on database permissions.
- Who is impacted: Appsmith server instances.
- Record
GHSA-h8cj-hpmg-636v- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.