SQL injection in Budibase MySQL integration (CVE-2026-73300)

The MySQL integration in Budibase is configured with `multipleStatements: true`, allowing execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise including data destruction, data theft, privilege escalation, and denial of service. Affected versions: - <3.40.0 We recommend updating to: 3.40.0. CVSS 9.6 · our assessment: act_now Reference: https://github.com/Budibase/budibase/security/advisories/GHSA-q6x4-v3qx-85qw Details: https://vuln.today/cve/CVE-2026-73300