appsmith releases

Review required

v2.1 Breaking risk · 5d

RCE / SSRF Dependencies Auth +1 more

SSRF filter + Caddy + Supervisord

Open

Review required

v2.0 Breaking risk · 13d

RCE / SSRF Auth Dependencies +1 more

Mandatory v1.99 intermediate upgrade

Open

v1.99 Breaking risk · 1mo

Security fixes

• CVE-2025-70952 (critical)
• CVE-2026-33937 (handlebars upgrade)
• CVE-2026-22732 (Spring Security HTTP headers)

Notable features

• AQL injection prevention in ArangoDB plugin
• Reflected XSS prevention in ManualUpgrades

View release on GitHub

v1.98 Security relevant · 2mo

Security fixes

• Enforced edit permissions for application snapshot deletion (GHSA-g2hc-wmw2-32jr)
• Prevented unauthenticated disclosure of instance metadata (APP-14994)
• Prevented SQL injection in UQI filter service projection and sortBy columns

Notable features

• TLS (SSL mode) support for Redis datasource

View release on GitHub

v1.97 New feature · 3mo

Security fixes

• Prevented open redirects in login and OAuth2 redirect flows

Notable features

• On-the-fly response compression in Caddy
• Favorite Applications (V2)
• New TableWidgetV2 style properties (headerRowColor, oddRowColor, evenRowColor)

View release on GitHub

v1.96 Security relevant · 3mo

Security fixes

• Fixed arbitrary file write vulnerability allowing writes outside repository scope
• Fixed XSS vulnerability in Table HTML cells
• Fixed OS command injection vulnerability when in-memory Git is enabled

Notable features

• Betterbugs SDK support

View release on GitHub

v1.95 Security relevant · 4mo

Security fixes

• Fixed issue where anonymous users could execute unpublished actions

Notable features

• Helm chart extraVolumes and extraVolumeMounts configuration options
• User display names on workspace members page
• Security warning message when process inspection is disabled

View release on GitHub