budibase vulnerabilities

CVEs whose affected-version data names the budibase package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

5 CVEsRSS

GHSA-qqf5-x7mj-v43pHigh· 8.4

3mo ago

budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

▾ Twilightbudibase · budibasevia GHSA

CVE-2026-48128Medium

3mo ago

Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step

▾ Sunlitbudibase · budibaseEPSS 0.33%via GHSA

CVE-2026-31818Critical· 9.6

5mo ago

Budibase is an open-source low-code platform

Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. The platform's SSRF protection mechanism (IP blacklist) is rendered…

▾ Midnightbudibase · budibaseEPSS 0.38%via NVD

CVE-2026-25044High· 8.8

5mo ago

Budibase is an open-source low-code platform

Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper sanitization or validation. User input is processed through processStringSync w…

▾ Twilightbudibase · budibaseEPSS 0.47%via NVD

CVE-2026-25043Medium· 5.3

5mo ago

Budibase is an open-source low-code platform

Budibase is an open-source low-code platform. Prior to version 3.23.25, a business logic vulnerability exists in Budibase’s password reset functionality due to the absence of rate limiting, CAPTCHA, or abuse prevention mechanisms on the …

▾ Sunlitbudibase · budibaseEPSS 0.30%via NVD