{"id":"CVE-2026-35219","title":"Budibase is an open-source low-code platform","summary":"Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, p…","severity":"high","cwe":["CWE-918"],"vendor":"budibase","product":"@budibase/server","affected":["@budibase/server < 3.41.3"],"patched":["@budibase/server 3.41.3"],"published":"2026-08-17","updated":"2026-09-08","sourceUpdated":"2026-09-08T21:03:08.410","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35219","references":[{"url":"https://github.com/Budibase/budibase/commit/cc07563a6b0fc0f91c51aae295952b1295546a90","label":"security-advisories@github.com"},{"url":"https://github.com/Budibase/budibase/pull/19328","label":"security-advisories@github.com"},{"url":"https://github.com/Budibase/budibase/releases/tag/3.41.3","label":"security-advisories@github.com"},{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-5fpj-28rv-84r7","label":"security-advisories@github.com"},{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-5fpj-28rv-84r7","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-5fpj-28rv-84r7"}],"tags":["nvd","ghsa","npm"],"epss":0.00268,"epssPercentile":0.19131,"aliases":["GHSA-5fpj-28rv-84r7"],"ecosystem":"npm","ingestedAt":"2026-08-14T19:20:04.067Z","slug":"CVE-2026-35219","body":"## Overview\n\nBudibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and packages/server/src/automations/steps/discord.ts use node-fetch on user-provided URLs without the BLACKLIST_IPS enforcement used by the REST integration, allowing an authenticated user to make server-side requests to cloud metadata and internal services. This issue is fixed in version 3.41.3.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-35219)\n\nAffected packages:\n\n- `@budibase/server < 3.41.3`\n\nPatched in:\n\n- `@budibase/server 3.41.3`\n\nSource: https://github.com/advisories/GHSA-5fpj-28rv-84r7","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}