Read the docs
TI-2026-20228 Aliases CVE-2026-25044GHSA-gjw9-34gf-rp6m

Budibase: Command Injection in Bash Automation Step

Priority MEDIUM 46CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper sanitization or validation. User input is processed through processStringSync which allows template interpolation, potentially allowing arbitrary command execution. This issue has been patched in version 3.33.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00474 41st percentileScored 2026-11-07
Fix Fixed budibase (Budibase): 3.33.4@budibase/server (npm): 3.33.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Budibasebudibasebefore 3.33.43.33.4Patch availableCNA
—@budibase/server (npm)before 3.33.43.33.4Patch availableGHSA-gjw9-34gf-rp6m
  • budibase VendorBudibase Affected before 3.33.4 Fixed in 3.33.4 Patch available CNA
  • @budibase/server (npm) Vendor— Affected before 3.33.4 Fixed in 3.33.4 Patch available GHSA-gjw9-34gf-rp6m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*before 3.33.4VulnerableBudibase
  • cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:* Versions before 3.33.4 Vulnerable ·Budibase

Remediation

  • Fix · CNA budibase (Budibase) Fixed in 3.33.4
  • Fix · GHSA-gjw9-34gf-rp6m @budibase/server (npm) Fixed in 3.33.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25044
  2. 2026-10-03 Alias added: GHSA-gjw9-34gf-rp6m

References

Advisory 2

Other 2

  • TI-2026-39242 Budibase: Anonymous NoSQL operator injection via published-app query templates CVSS 3.1CRITICAL 10.0
  • TI-2026-24369 Budibase Universal Auth Bypass via Webhook Query Param Injection CVSS 3.1CRITICAL 9.1
  • TI-2026-39244 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload CVSS 3.1CRITICAL 9.6
  • TI-2026-39243 Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override CVSS 3.1CRITICAL 9.6
  • TI-2026-24371 Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist CVSS 3.1CRITICAL 9.9
  • TI-2026-23473 Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets CVSS 3.1CRITICAL 9.6
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences