Retool CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Retool CVE published 2026-10-22

CVE-2024-58394

CVE-2024-58394 is a cross-site scripting vulnerability in Retool before version 3.88.0. The vulnerability allows unauthenticated attackers to execute scripts by proxying malicious SVG files through the /api/imageProxy endpoint. Attackers can supply an attacker-hosted SVG in the url parameter, which is served from the Retool origin without a Content Security Policy, executing JavaScript in victims' session [truncated]