CVE-2026-25044High· 8.8▾ TwilightBudibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper sanitization or validation. User input is processed through processStringSync w…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
Last analysed / modified upstream
Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper sanitization or validation. User input is processed through processStringSync which allows template interpolation, potentially allowing arbitrary command execution. This issue has been patched in version 3.33.4.
budibase < 3.33.4Upgrade past the affected range:
budibase 3.33.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-35216Critical· 9.0Budibase is an open-source low-code platform
CVE-2026-33226High· 8.7Budibase is a low code platform for creating internal tools, workflows, and admin panels
CVE-2026-35214High· 8.7Budibase is an open-source low-code platform
CVE-2026-103757High· 7.7Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist
CVE-2026-31818Critical· 9.6Budibase is an open-source low-code platform
CVE-2026-25043Medium· 5.3Budibase is an open-source low-code platform