Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
This advisory covers three distinct SQL Injection vulnerabilities within Budibase's database connectors (PostgreSQL, Microsoft SQL Server, and MySQL). Because user-controlled schema and table configurations are interpolated directly into raw SQL queries without proper escaping or parameterization during database introspection, an authenticated administrator can break out of string delimiters. This allows for arbitrary DDL/DML execution, database compromise, and potential underlying OS command execution (e.g., via MS SQL xpcmdshell). Details Vulnerability Type & Title PostgreSQL SET searchpath SQL Injection Description & Root Cause The schema datasource config field is interpolated directly into a raw SQL statement without proper escaping. Double quotes inside the schema name are not escaped, allowing an attacker to break out of the string literal and inject arbitrary SQL. Vulnerable Code: File: packages/server/src/integrations/postgres.ts, lines 355–358 node-postgres sends…
Recommended action: Upgrade to 3.39.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The executeQuery automation step in Budibase accepts a queryId from automation step inputs and passes it directly to the query execution controller without additional validation. When combined with a REST datasource configured to target internal infrastructure, this creates a server-side request forgery path where automation execution causes the Budibase server to make outbound HTTP requests to attacker-influenced destinations. The automation output then returns the response, potentially exposing internal service data. Details Inside the execute query automation step, the queryId value and any additional query parameters from inputs.query are assembled into a request context and forwarded to queryController.executeV2AsAutomation. The constructed context looks like the following: No validation is performed to confirm that the referenced query is appropriate for automation use, that the associated datasource targets an allowlisted destination, or that the supplied parameters do…
Recommended action: Upgrade to 3.39.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The file upload endpoint POST /api/attachments/process does not enforce active-content restrictions for authenticated users. The checks for dangerous file extensions (html, svg, js, php, etc.) are conditionally wrapped inside if (isPublicUser) or if (isPublicUser || !env.SELFHOSTED), meaning any authenticated builder can upload executable web content — SVG files with inline <script tags, HTML pages with JavaScript, .js modules — which are then stored in the object store (MinIO/S3) with their correct MIME types (image/svg+xml, text/html, application/javascript). When the resulting signed URL is opened by any app user, the browser executes the payload. Impact is persistent stored XSS over all application end users. Details The vulnerability exists in a single handler function uploadFile shared by two routes, located in packages/server/src/api/controllers/static/index.ts (lines 93–179). Route definitions (packages/server/src/api/routes/static.ts): POST /api/attachments/process →…
Recommended action: Upgrade to 3.38.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The row action trigger endpoint (POST /api/tables/:sourceId/actions/:actionId/trigger) fails to validate that the user-supplied rowId is within the scope of the view's row filters. A user with access to a filtered view can trigger row actions on any row in the underlying table, including rows explicitly excluded by the view's security filters. Details View filters in Budibase are treated as a security boundary. The search path (packages/server/src/sdk/workspace/rows/search.ts:93-94) explicitly enforces view query filters with the comment: "that could let users find rows they should not be allowed to access." However, the row action trigger path bypasses this enforcement entirely: 1. Route (packages/server/src/api/routes/rowAction.ts:55-59): Accepts a sourceId that can be a viewId. 2. Middleware (packages/server/src/middleware/triggerRowActionAuthorised.ts:24-55): Correctly validates that the user has READ permission on the view and that the row action is enabled for that…
Recommended action: Upgrade to 3.38.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
1. Summary | Field | Value | |-------|-------| | Title | SSRF via trivial .tar.gz substring bypass in Plugin URL upload | | Product | Budibase (Self-Hosted) | | Version | ≤ 3.34.11 (latest stable as of 2026-03-30) | | Component | packages/server/src/api/controllers/plugin/url.ts | | Vulnerability Type | CWE-918: Server-Side Request Forgery (SSRF), CWE-184: Incomplete List of Disallowed Inputs | | Severity | High (chained) / Medium (standalone) | | CVSS 3.1 Score (chained) | 7.7 — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N | | CVSS 3.1 Score (standalone) | 5.4 — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | | Attack Vector | Network | | Privileges Required | Low (Global Builder role) | | User Interaction | None | | Affected Deployments | All Budibase instances with plugin loading enabled (default) | --- 2. Description The Plugin URL upload endpoint (POST /api/plugin) validates the submitted URL with a single substring check: url.includes(".tar.gz"). Any URL containing .tar.gz…
Recommended action: Upgrade to 3.35.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A critical unsafe eval() vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. This vulnerability ONLY affects Budibase Cloud (SaaS) - self-hosted deployments use native CouchDB views and are not vulnerable. The vulnerability exists in packages/server/src/db/inMemoryView.ts where user-controlled view map functions are directly evaluated without sanitization. The primary impact comes from what lives inside the pod's environment: the app-service pod runs with secrets baked into its environment variables, including INTERNALAPIKEY, JWTSECRET, CouchDB admin credentials, AWS keys, and more. Using the extracted CouchDB credentials, we verified direct database access, enumerated all tenant databases, and confirmed that user records (email addresses) are readable. Details Root Cause File: packages/server/src/db/inMemoryView.ts:28 Why Only Cloud is Vulnerable: File:…
Recommended action: Upgrade to 3.30.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.