Skip to content
OpenAdvisories

Package · npm

@budibase/backend-core

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-41428

    Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints

    Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an att…

    Budibase budibase @budibase/backend-core npm
  • Critical 9.6
    CVE-2026-31818

    Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist

    Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. The platform's SSRF protection mechanism (IP blacklist) is rendered completely ineffectiv…

    Budibase budibase @budibase/backend-core npm