---
id: CVE-2024-58394
title: Retool 3.88.0 XSS via /api/imageProxy SVG Proxying
summary: >-
  Retool before 3.88.0 contains a cross-site scripting vulnerability that allows
  unauthenticated attackers to execute scripts by proxying malicious SVG files
  through /api/imageProxy. Attackers can supply an attacker-hosted SVG in the
  url p…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: Retool
product: Retool
affected:
  - Retool < 3.88.0
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T10:57:37.409Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-58394'
references:
  - url: 'https://docs.retool.com/releases/edge/version/3.88'
    label: 3.88 Release Notes
  - url: >-
      https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/retool/retool-svg-xss.yaml
    label: Nuclei Template
  - url: >-
      https://www.vulncheck.com/advisories/retool-3.88.0-xss-via-api-imageproxy-svg-proxying
    label: 'VulnCheck Advisory: Retool 3.88.0 XSS via /api/imageProxy SVG Proxying'
tags:
  - cve.org
ingestedAt: '2026-10-22T11:37:02.341Z'
---

## Overview

Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy. Attackers can supply an attacker-hosted SVG in the url parameter, which is served from the Retool origin without a Content Security Policy, executing JavaScript in victims' sessions. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-10-15.

## Affected

- `Retool < 3.88.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.