Medium severity · published May 18, 2022
CVE-2022-23068
ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user…
5.4
CVSS
0.6%
EPSS
No
On KEV
Description
ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user which will be reflected in the invitational e-mail.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
Tooljet · Tooljet
0.6.0 through 1.10.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23068
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23068
Patch
https://github.com/ToolJet/ToolJet/commit/431dc961cdfe4d26343d1c1c951ced778fbddb58
Exploit
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23068
More from Tooljet
9.9
CVE-2026-82874
ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db
9.6
CVE-2026-82870
ToolJet before v3.16.208 Cross-Tenant Database Manipulation
9.4
CVE-2026-55413
ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution
9.1
CVE-2026-82872
ToolJet before v3.16.208 Cross-Workspace Authorization Bypass
8.8
CVE-2026-54344
ToolJet GitHub Actions comment body shell injection exposes deployment secrets