Vulnerabilities

TI-2024-39149 CVE-2024-58394 · GHSA-h68x-76fm-hh89

Cross-site scripting in Retool image proxy lets attackers run scripts

LOW 29

Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00204 Published 2026-10-22 Fixed in 3.88.0 CWE-79

TI-2025-29932 CVE-2025-47424 · GHSA-xw45-9vvw-6qg3

Retool (self-hosted) before 3.196.0 allows Host header injection.

LOW 32

Retool (self-hosted) before 3.196.0 allows Host header injection.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00158 Published 2025-05-09 No fix listed CWE-348

TI-2024-28062 CVE-2024-42056 · GHSA-f3c7-2m22-wr7x

Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication…

LOW 28

Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication credentials into sent data.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0021 Published 2024-08-22 No fix listed CWE-352

Vulnerabilities

Filters

Cross-site scripting in Retool image proxy lets attackers run scripts

Retool (self-hosted) before 3.196.0 allows Host header injection.

Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication…