Description
Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass per-user access controls, read arbitrary documents, execute JavaScript via $where operators, or modify collections through update and delete operations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| budibase | server | < 3.40.0 | 3.40.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @budibase/server | <= 3.38.1 | — | GHSA-pmpg-2mxq-6xwr |
References
- GitHub Security Advisory (GHSA-pmpg-2mxq-6xwr) vendor-advisory
- VulnCheck Advisory: Budibase before 3.40.0 NoSQL Injection via MongoDB datasource third-party-advisory