megachangelog
Security1.99

Release v1.99

v1.99 includes critical security fixes for CVE-2025-70952 and multiple vulnerabilities including SSRF, XSS, and SQL injection prevention, along with bug fixes for imports, widgets, datasources, and email normalization.

Fixes

  • Prevented imports from corrupting published layoutOnLoadActions. (#41737)
  • Prevented automatic semicolon insertion (ASI) in wrapCode from causing refactoring failures. (#41727)
  • Removed an extra nfs field from the persistentVolume object. (#41724)
  • Updated BetterBugs recording links to use the new package URLs. (#41667)
  • Replaced PAT with GITHUB_TOKEN in the cleanup-dp workflow. (#41699)
  • Fixed styling issues with scrollbar select widgets. (#41656)
  • Prevented a super user creation race condition. (GHSA-9wcp-79g5-5c3c) (#41681)
  • Blocked SSRF via send-test-email SMTP host validation. (GHSA-vvxf-f8q9-86gh) (#41666)
  • Fixed critical CVE-2025-70952. (#41673)
  • Upgraded handlebars to 4.7.9 to resolve CVE-2026-33937. (#41672)
  • Mitigated CVE-2026-22732, where Spring Security HTTP headers were not being written. (#41669)
  • Fixed an issue where datasource queries did not fail when the createdAt field was missing. (#41665)
  • Normalized user emails on save to remove invisible Unicode characters. (#41664)
  • Enforced ACL permission checks in OAuth2 callback datasource lookup. (GHSA-rg2x-4v4h-g78w) (#41640)
  • Validated the filter temp table name before DROP TABLE. (#41642)
  • Prevented AQL injection in the ArangoDB plugin caused by unsafe string concatenation. (#41641)
  • Expanded the metadata denylist to strengthen SSRF protection. (GHSA-9m89-5jw7-q5cr) (#41643)
  • Hardened admin environment value escaping. (#41637)
  • Sanitized URLs in ManualUpgrades to prevent reflected XSS. (#41636)
  • Enforced edit permissions for application snapshot deletion. (GHSA-g2hc-wmw2-32jr) (#41624)
securityfixstabilityvulnerabilitiesssrfxss

Source: original entry ↗

More from Appsmith

Follow Appsmith to get its new changes in your feed and email digest.

Announcement2.5.0

Release v2.5.0

Appsmith v2.5.0 includes security patches for bundled dependencies, stricter datasource credential handling and permission checks, schema updates for Git-connected applications with potential breaking changes to Elasticsearch bindings, and new features like application descriptions, list widget selection controls, and enhanced table column formatting. Appsmith AI reached end-of-life on September 30, 2026 and can no longer be used.

securitybreakingdatasourceschemagit
Announcement2.4.3

Release v2.4.3

Appsmith v2.4.3 includes end-of-life notice for Appsmith AI (September 30, 2026), security updates for bundled dependencies, improved error message handling in action executions, and UI enhancements like font controls in Rich Text Editor and restored search/filtering in Table widgets.

securityreliabilityui-widgetsdeprecationconfiguration
Announcement2.4.2

Release v2.4.2

Appsmith v2.4.2 includes security updates for bundled dependencies including Bouncy Castle, fixes for page cloning performance to prevent memory exhaustion, improved UI consistency for Ask AI and OAuth2 fields, and enhancements to Git and deployment tools. Appsmith AI reaches end-of-life on September 30, 2026, and users must migrate to direct provider datasources.

securityperformanceuireliabilitydeployment
See all Appsmith changes →