Skip to content
OpenAdvisories

Package · npm

@budibase/server

42 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.0
    CVE-2026-73302

    Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

    Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email without getEmailVerified or an email_verified requirement, and packages/backend-core/src/middleware/pa…

    Budibase budibase @budibase/server npm
  • Critical 9.0
    CVE-2026-73407

    Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152))

    Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration._req in packages/server/src/integrations/rest.ts attached credentials from getAuthHeaders and defaultHeaders without requiring the final request destination to match the datasource…

    Budibase budibase @budibase/server npm
  • Critical 9.6
    CVE-2026-73300

    Budibase: SQL Injection via `multipleStatements: true`

    Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL command…

    Budibase budibase @budibase/server npm
  • Critical 10.0
    CVE-2026-54350 Public exploit

    Budibase: Anonymous NoSQL operator injection via published-app query templates

    Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection and, where the bu…

    Budibase budibase @budibase/server npm
  • Critical 9.6
    CVE-2026-54352

    Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload

    Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with extract-zip@2.0.1 into a temp directory, then for each entry listed in …

    Budibase budibase @budibase/server npm
  • Critical 9.0
    CVE-2026-48150

    Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign

    Budibase is an open-source low-code platform. Prior to 3.39.0, /api/public/v1/roles/assign is guarded by the builderOrAdmin middleware, which passes any user who is a builder for the app id in the x-budibase-app-id header. That check admits both global builde…

    Budibase budibase @budibase/server npm
  • Critical 9.1
    CVE-2026-35216 EPSS 11%

    Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step

    Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authent…

    Budibase budibase @budibase/server npm
  • Critical 9.8
    GHSA-4g2x-vq5p-5vj6

    Budibase affected by VM2 Constructor Escape Vulnerability

    ### Impact Previously, budibase used a library called `vm2` for code execution inside the Budibase builder and apps, such as the UI below for configuring bindings in the design section. ![Screenshot 2024-03-01 at 13 50 16](https://github.com/Budibase/budibase…

    @budibase/server npm