EUVD-2026-18795
GHSA-fcm4-4pj2-m5hf
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4.
AnalysisAI
Remote code execution in Budibase versions prior to 3.33.4 allows unauthenticated attackers to execute arbitrary Bash commands with root privileges inside the application container by exploiting public webhook endpoints that trigger automation workflows. The vulnerability stems from improper neutralization of special elements in OS commands (CWE-78) and requires no authentication, though the CVSS complexity is rated high (AC:H). A vendor-released patch is available in version 3.33.4, with the fix publicly documented in GitHub pull request #18238 and commit f0c731b4.
Technical ContextAI
Budibase is an open-source low-code application development platform that enables users to build internal tools through visual workflows and automations. The vulnerability exploits the automation engine's Bash execution step capability, which can be triggered through public webhook endpoints without authentication validation. The root cause is OS command injection (CWE-78), where user-controlled input reaches the Bash interpreter without proper sanitization. The affected component is cpe:2.3:a:budibase:budibase prior to version 3.33.4. The platform's architecture runs the automation engine with root privileges inside containerized deployments, amplifying the impact scope. Public webhook endpoints are designed for third-party integrations but lacked authentication enforcement for automation triggers containing script execution steps, creating an unauthenticated code execution path.
RemediationAI
Upgrade immediately to Budibase version 3.33.4 or later, which contains the security patch addressing the unauthenticated RCE vulnerability. The fix is documented in GitHub pull request https://github.com/Budibase/budibase/pull/18238 and implemented in commit f0c731b409a96e401445a6a6030d2994ff4ac256, available in the official 3.33.4 release at https://github.com/Budibase/budibase/releases/tag/3.33.4. If immediate patching is not possible, implement network-level access controls to restrict webhook endpoint access to trusted IP ranges, disable public webhook functionality for automations containing Bash execution steps, or remove Bash step capabilities from automation workflows until patching is completed. Review container security configurations to implement principle of least privilege and consider running Budibase processes as non-root users where deployment architecture permits.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an
Authentication bypass in Budibase low-code platform (versions prior to 3.35.4) allows remote unauthenticated attackers t
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today