EUVD-2026-18754
GHSA-gjw9-34gf-rp6m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper sanitization or validation. User input is processed through processStringSync which allows template interpolation, potentially allowing arbitrary command execution. This issue has been patched in version 3.33.4.
AnalysisAI
Remote code execution in Budibase low-code platform versions prior to 3.33.4 enables authenticated attackers to execute arbitrary system commands through the bash automation step feature. The vulnerability stems from unsanitized user input processed via template interpolation in execSync calls, allowing command injection with low attack complexity. No public exploit identified at time of analysis, though the technical details disclosed in the GitHub Security Advisory provide a clear exploitation path for authenticated users with automation privileges.
Technical ContextAI
Budibase is an open-source low-code application development platform (cpe:2.3:a:budibase:budibase) that provides automation capabilities including bash command execution. The vulnerability exists in the bash automation step functionality where user-supplied commands are passed to Node.js execSync without proper input validation. The processStringSync function performs template interpolation on user input before execution, creating a classic command injection vector (CWE-78). This allows attackers to break out of intended command contexts using shell metacharacters and template syntax to inject additional commands. The vulnerability affects the core automation engine that processes workflow definitions, meaning any authenticated user with permissions to create or modify automation workflows can exploit this flaw to achieve arbitrary command execution on the Budibase server with the privileges of the application process.
RemediationAI
Upgrade immediately to Budibase version 3.33.4 or later, which implements proper input sanitization and validation for bash automation steps. The vendor-released patch is available through the official Budibase GitHub repository at https://github.com/Budibase/budibase/releases/tag/3.33.2 (note: verify you deploy 3.33.4 specifically as the description indicates this is the fully patched version). Organizations unable to upgrade immediately should implement compensating controls including restricting automation creation privileges to only highly trusted administrators, implementing audit logging for all automation workflow modifications, and reviewing existing automation workflows for potentially malicious bash commands. Consider disabling the bash automation step feature entirely if not required for business operations until patching is complete. Network segmentation can limit post-exploitation impact by restricting the Budibase server's access to sensitive internal resources. Review security advisory GHSA-gjw9-34gf-rp6m for additional vendor guidance and technical details on the fix implementation.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an
Authentication bypass in Budibase low-code platform (versions prior to 3.35.4) allows remote unauthenticated attackers t
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today