Description
Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Budibase | budibase | < 3.40.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @budibase/server | <= 3.38.1 | — | GHSA-q6x4-v3qx-85qw |
Advisories 1
- WID-SEC-2026-2483 Budibase: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 17, 2026