What is the CVSS score of CVE-2026-25041?

CVE-2026-25041 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PostgreSQL are affected by CVE-2026-25041?

Budibase versions 3.23.22 and earlier contain a critical command injection vulnerability in PostgreSQL database integration that could allow attackers to execute arbitrary system commands on affected…. A patch is available.

How to fix or mitigate CVE-2026-25041?

Within 24 hours: Inventory all Budibase instances and identify those running version 3.23.22 or earlier with PostgreSQL integration enabled. Within 7 days: Implement network segmentation to restrict Budibase server outbound access and disable PostgreSQL integration if not actively required. Within 30 days: Monitor vendor communications for patch availability and prepare a patching strategy; consider migrating critical workflows to alternative platforms if patches remain unavailable.

PostgreSQL CVE-2026-25041

HIGH

OS Command Injection (CWE-78)

2026-03-09 security-advisories@github.com

GHSA-726g-59wr-cj4c

PostgreSQL Command Injection Budibase

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

CVE Published

Mar 09, 2026 - 20:16 nvd

HIGH 7.2

DescriptionGitHub Advisory

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.23.22 and earlier, the PostgreSQL integration constructs shell commands using user-controlled configuration values (database name, host, password, etc.) without proper sanitization. The password and other connection parameters are directly interpolated into a shell command. This affects packages/server/src/integrations/postgres.ts.

AnalysisAI

Command injection in Budibase 3.23.22 and earlier allows authenticated attackers with high privileges to execute arbitrary system commands by injecting malicious values into PostgreSQL connection parameters that are unsanitized in shell command construction. An attacker with administrative access can exploit this vulnerability to gain complete control over the underlying server hosting the Budibase instance. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-78 (OS Command Injection). Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.23.22 and earlier, the PostgreSQL integration constructs shell commands using user-controlled configuration values (database name, host, password, etc.) without proper sanitization. The password and other connection parameters are directly interpolated into a shell command. This affects packages/server/src/integrations/postgres.ts.