Appsmith v1.96 Release
This release includes new features like Betterbugs SDK support and a Tooltip property for Checkbox widgets, along with critical security fixes for file write, XSS, and OS command injection vulnerabilities, plus improvements to resource management and HTML content handling.
Features
Fixes
- Fixed an arbitrary file write vulnerability that allowed writes outside the repository scope. (#41565)
- Added a
getTextFromHTMLfallback and normalized search keys to properly handle HTML content. (#41553) - Fixed an XSS vulnerability in Table HTML cells. (#41539)
- Closed InputStreams after
StreamUtils.copyToStringto prevent resource leaks. (#41516) - Fixed an issue where stale actions could not read contents. (#41533)
- Updated MongoDB feature compatibility version (FCV) to 6. (#41534)
- Fixed an OS command injection vulnerability when in-memory Git is enabled. (#41525)
Source: original entry ↗
More from Appsmith
Follow Appsmith to get its new changes in your feed and email digest.
Release v2.5.0
Appsmith v2.5.0 includes security patches for bundled dependencies, stricter datasource credential handling and permission checks, schema updates for Git-connected applications with potential breaking changes to Elasticsearch bindings, and new features like application descriptions, list widget selection controls, and enhanced table column formatting. Appsmith AI reached end-of-life on September 30, 2026 and can no longer be used.
Release v2.4.3
Appsmith v2.4.3 includes end-of-life notice for Appsmith AI (September 30, 2026), security updates for bundled dependencies, improved error message handling in action executions, and UI enhancements like font controls in Rich Text Editor and restored search/filtering in Table widgets.
Release v2.4.2
Appsmith v2.4.2 includes security updates for bundled dependencies including Bouncy Castle, fixes for page cloning performance to prevent memory exhaustion, improved UI consistency for Ask AI and OAuth2 fields, and enhancements to Git and deployment tools. Appsmith AI reaches end-of-life on September 30, 2026, and users must migrate to direct provider datasources.