NoSQL operator injection in Budibase published-app query templates (CVE-2026-54350)

The `enrichContext` function in `@budibase/server` substitutes user-supplied parameter values directly into raw JSON query bodies without escaping JSON metacharacters, allowing an attacker to inject NoSQL operators into the parsed filter object. Because the `authorized` middleware bypasses both authentication and CSRF enforcement for queries with a `PUBLIC` role, an unauthenticated attacker can exploit this with a single HTTP request-no session required-to read every document from any backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection reachable through a published PUBLIC query, or to modify every document in that collection where a PUBLIC write query has been published. Affected versions: - <= 3.39.0 We recommend updating to: 3.39.12. CVSS 9.8 · our assessment: act_now Reference: https://github.com/Budibase/budibase/security/advisories/GHSA-8qv3-p479-cj62 Details: https://vuln.today/cve/CVE-2026-54350