Skip to content
OpenAdvisories

Package · npm

@budibase/server

42 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

42 results · Feed

  • High 8.6
    CVE-2026-25041

    Budibase has a Command Injection in PostgreSQL Dump Command

    Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.23.22 and earlier, the PostgreSQL integration constructs shell commands using user-controlled configuration values (database name, host, password, etc.) without pro…

    Budibase budibase @budibase/server npm
  • Critical 9.8
    GHSA-4g2x-vq5p-5vj6

    Budibase affected by VM2 Constructor Escape Vulnerability

    ### Impact Previously, budibase used a library called `vm2` for code execution inside the Budibase builder and apps, such as the UI below for configuring bindings in the design section. ![Screenshot 2024-03-01 at 13 50 16](https://github.com/Budibase/budibase…

    @budibase/server npm