Read the docs
TI-2026-22078 Aliases CVE-2026-27702GHSA-rvhr-26g4-p2r8

Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)

Priority HIGH 76CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe `eval()` vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. This vulnerability ONLY affects Budibase Cloud (SaaS) - self-hosted deployments use native CouchDB views and are not vulnerable. The vulnerability exists in `packages/server/src/db/inMemoryView.ts` where user-controlled view map functions are directly evaluated without sanitization. The primary impact comes from what lives inside the pod's environment: the `app-service` pod runs with secrets baked into its environment variables, including `INTERNAL_API_KEY`, `JWT_SECRET`, CouchDB admin credentials, AWS keys, and more. Using the extracted CouchDB credentials, we verified direct database access, enumerated all tenant databases, and confirmed that user records (email addresses) are readable. Version 3.30.4 contains a patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00391 33rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed budibase (Budibase): 3.30.4budibase (npm): 3.30.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Budibasebudibasebefore 3.30.43.30.4Patch availableCNA
—budibase (npm)before 3.30.43.30.4Patch availableGHSA-rvhr-26g4-p2r8
  • budibase VendorBudibase Affected before 3.30.4 Fixed in 3.30.4 Patch available CNA
  • budibase (npm) Vendor— Affected before 3.30.4 Fixed in 3.30.4 Patch available GHSA-rvhr-26g4-p2r8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*before 3.30.4VulnerableBudibase
  • cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:* Versions before 3.30.4 Vulnerable ·Budibase

Remediation

  • Fix · CNA budibase (Budibase) Fixed in 3.30.4
  • Fix · GHSA-rvhr-26g4-p2r8 budibase (npm) Fixed in 3.30.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27702
  2. 2026-10-03 Alias added: GHSA-rvhr-26g4-p2r8
  3. 2026-10-23 EPSS moved to the 50th–90th percentile
  4. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2026-39242 Budibase: Anonymous NoSQL operator injection via published-app query templates CVSS 3.1CRITICAL 10.0
  • TI-2026-24369 Budibase Universal Auth Bypass via Webhook Query Param Injection CVSS 3.1CRITICAL 9.1
  • TI-2026-39244 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload CVSS 3.1CRITICAL 9.6
  • TI-2026-39243 Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override CVSS 3.1CRITICAL 9.6
  • TI-2026-24371 Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist CVSS 3.1CRITICAL 9.9
  • TI-2026-23473 Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets CVSS 3.1CRITICAL 9.6
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences