Skip to content

appsmith

v2.2 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 18d Developer Productivity
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Topics

admin-dashboard admin-panels app-builder automation crud custom-internal
+13 more
developer-tools gui gui-application internal-tools java javascript low-code low-code-framework react self-hosted typescript webdevelopment workflows

Affected surfaces

deps breaking_upgrade

ReleasePort's take

Moderate signal
editorial:auto 10d

The Appsmith v2.2 release blocks Redis datasource connections to the internal instance and removes the hardcoded IN_DOCKER environment variable, replacing it with APPSMITH_DISABLE_SSRF_FILTER.

Why it matters: Blocked Redis connections prevent external access to the internal Appsmith Redis instance; removal of IN_DOCKER requires updating Docker‑based deployments to use APPSMITH_DISABLE_SSRF_FILTER before upgrade.

Summary

AI summary

Updates Breaking changes, GHSA-qhfj-g87x-m39w, and GHSA-q7cg-457f-vx79 across a mixed release.

Changes in this release

Security Critical

Blocked Redis datasource connections to internal Appsmith Redis instance.

Blocked Redis datasource connections to internal Appsmith Redis instance.

Source: llm_adapter@2026-07-16

Confidence: high

 —
Security Critical

Upgraded joi to 18.2.1 to address CVE-2026-48038.

Upgraded joi to 18.2.1 to address CVE-2026-48038.

Source: llm_adapter@2026-07-16

Confidence: high

 —
Security High

Applied dependency updates to address 17 security vulnerabilities.

Applied dependency updates to address 17 security vulnerabilities.

Source: llm_adapter@2026-07-16

Confidence: high

 —
Security High

Upgraded Spring Boot to 3.5.14 and Netty to 4.1.135 to address multiple CVEs.

Upgraded Spring Boot to 3.5.14 and Netty to 4.1.135 to address multiple CVEs.

Source: llm_adapter@2026-07-16

Confidence: high

 —
Security High

Applied dependency updates to address 15 additional security vulnerabilities.

Applied dependency updates to address 15 additional security vulnerabilities.

Source: llm_adapter@2026-07-16

Confidence: high

 —
Security High

Applied dependency updates to address 1 additional security vulnerability.

Applied dependency updates to address 1 additional security vulnerability.

Source: llm_adapter@2026-07-16

Confidence: high

 —
Security High

Replaced innerHTML and dangerouslySetInnerHTML with safer alternatives.

Replaced innerHTML and dangerouslySetInnerHTML with safer alternatives.

Source: llm_adapter@2026-07-16

Confidence: high

 —
Breaking High

Removed hardcoded IN_DOCKER environment variable; introduced APPSMITH_DISABLE_SSRF_FILTER.

Removed hardcoded IN_DOCKER environment variable; introduced APPSMITH_DISABLE_SSRF_FILTER.

Source: llm_adapter@2026-07-16

Confidence: high

 —
Feature Medium

Added support for copying APIs, queries, and JavaScript objects between applications.

Added support for copying APIs, queries, and JavaScript objects between applications.

Source: llm_adapter@2026-07-16

Confidence: high

 —
Bugfix Medium

Prevented Community Edition from starting when connected to a database previously used by Enterprise Edition.

Prevented Community Edition from starting when connected to a database previously used by Enterprise Edition.

Source: llm_adapter@2026-07-16

Confidence: high

 —
Bugfix Low

Fixed Storybook issues by removing an overly broad minimatch resolution, allowing glob v10/v11 to correctly support GLOBSTAR.

Fixed Storybook issues by removing an overly broad minimatch resolution, allowing glob v10/v11 to correctly support GLOBSTAR.

Source: granite4.1:30b@2026-07-16-audit

Confidence: low

 —
Bugfix Low

Improved Git error handling by distinguishing a missing default branch from an SSH key misconfiguration.

Improved Git error handling by distinguishing a missing default branch from an SSH key misconfiguration.

Source: granite4.1:30b@2026-07-16-audit

Confidence: low

 —
Bugfix Low

Ensured cloned pages generate unique widget IDs, preventing widget conflicts.

Ensured cloned pages generate unique widget IDs, preventing widget conflicts.

Source: granite4.1:30b@2026-07-16-audit

Confidence: low

 —
Bugfix Low

Fixed SSO login redirects to land on the originally requested application instead of /applications.

Fixed SSO login redirects to land on the originally requested application instead of /applications.

Source: granite4.1:30b@2026-07-16-audit

Confidence: low

 —
Full changelog

Features

  • Added support for copying APIs, queries, and JavaScript objects between applications. (#41919) (#41920)
  • Prevented Community Edition from starting when connected to a database previously used by Enterprise Edition. (#41906)

Fixes

  • Blocked Redis datasource connections to the internal Appsmith Redis instance. (GHSA-qhfj-g87x-m39w) (#41921)
  • Fixed Storybook issues by removing an overly broad minimatch resolution, allowing glob v10/v11 to correctly support GLOBSTAR. (#41949)
  • Applied a batch of dependency updates to address 17 security vulnerabilities identified during release image scans. (#41947)
  • Upgraded Spring Boot to 3.5.14 and Netty to 4.1.135 to address multiple CVEs. (#41928)
  • Improved Git error handling by distinguishing a missing default branch from an SSH key misconfiguration. (#41940)
  • Applied dependency updates to address 1 additional security vulnerability. (#41942)
  • Ensured cloned pages generate unique widget IDs, preventing widget conflicts. (#41762)
  • Applied dependency updates to address 15 additional security vulnerabilities. (#41913)
  • Upgraded joi to 18.2.1 to address CVE-2026-48038. (GHSA-q7cg-457f-vx79) (#41891)
  • Added validation to ensure pages belong to the correct application during partial exports. (GHSA-9xfc-9f97-x524) (#41832)
  • Improved test stability by wrapping the PropertyPaneTitle F2 assertion in waitFor. (#41888)
  • Fixed an issue where SSO login redirects landed on /applications instead of the originally requested application. (#41820)
  • Replaced innerHTML and dangerouslySetInnerHTML with safer alternatives to improve security. (#41836)

Breaking changes

  • The hardcoded IN_DOCKER environment variable in the published image has been removed. It has been replaced with a new environment variable APPSMITH_DISABLE_SSRF_FILTER which can be used in local development to reach local HTTP and Redis datasources. (#41921)

Breaking Changes

  • Removed hardcoded IN_DOCKER environment variable; replaced with APPSMITH_DISABLE_SSRF_FILTER for local development access to HTTP and Redis datasources.

Security Fixes

  • GHSA-qhfj-g87x-m39w — Blocked Redis datasource connections to the internal Appsmith Redis instance (SSRF fix).
  • GHSA-q7cg-457f-vx79 — Upgraded joi to 18.2.1 addressing CVE‑2026‑48038.
  • CVE-2026-48038
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track appsmith

Get notified when new releases ship.

Sign up free

About appsmith

Platform to build admin panels, internal tools, and dashboards. Integrates with 25+ databases and any API.

All releases →

Related context

Related CVEs

Earlier breaking changes

  • v2.0 Direct upgrades from pre‑v1.96 versions to 2.0+ will fail; intermediate upgrade through v1.99 required
  • v2.0 Direct upgrades from <v1.96 to 2.0+ are blocked; must upgrade through v1.99 first
  • v2.0 Blocks direct upgrade to 2.0+ from versions pre-v1.96

Beta — feedback welcome: [email protected]