Budibase CVE-2026-42239

Requires two preconditions to achieve account takeover: First, the presence of an exploitable Cross-Site Scripting (XSS) vulnerability in the Budibase instance - this could be stored XSS in entity names (confirmed in GHSA-gp5x-2v54-v2q5), reflected XSS in query parameters, or DOM-based XSS in client-side rendering. Second, requires a privileged user (PR:H - administrator or developer with access to sensitive entities) to trigger the XSS payload through normal platform usage (UI:R - viewing entity lists, dashboards, or reports). The cookie misconfiguration itself is present in default Budibase deployments prior to 3.35.10 requiring no special configuration. Attack vector is network-based (AV:N) meaning remote exploitation is possible without local access. Attack complexity is low (AC:L) once an XSS vector is identified. Scope change (S:C) indicates the JWT token can be used beyond the XSS context for persistent access. Limitations on exploitation: requires chaining with another vulnerability (XSS), requires victim user interaction to view malicious content, and relies on network visibility to exfiltration endpoint (blockable by egress filtering though bypasses exist via DNS exfiltration or legitimate external resources).

Real-world risk is HIGH due to confirmed prior XSS vulnerabilities in Budibase ecosystem that can leverage this cookie exposure. The CVSS score of 8.1 (High) reflects the potential for complete account takeover (C:H/I:H) with scope change (S:C), though requires privileged user interaction (PR:H/UI:R) limiting automatic exploitation. Attack complexity is low (AC:L) and vector is network-based (AV:N). The critical multiplier here is that this vulnerability does not stand alone - it amplifies the impact of every XSS bug from session riding to persistent credential theft. GitHub security advisory GHSA-4f9j-vr4p-642r explicitly links this to GHSA-gp5x-2v54-v2q5, a stored XSS via unsanitized entity names published April 2026, creating a proven attack chain. The missing secure flag means cookies can be intercepted over HTTP if HTTPS is not enforced. Missing sameSite allows cross-site request attachment attacks. No EPSS or KEV data available. SSVC assessment: exploitation status is publicly available (GitHub advisory with PoC code), technical impact is total (account takeover), automatable is no (requires XSS chaining). Priority is MEDIUM-HIGH for organizations running Budibase, especially if exposed to untrusted users who can create entities. The fix is simple (configuration change) and available in released version 3.35.10, reducing urgency compared to unpatched vulnerabilities.

Attacker discovers a stored XSS vulnerability in Budibase entity name fields (as documented in GHSA-gp5x-2v54-v2q5). Attacker creates a database entity with name containing JavaScript payload that reads document.cookie and exfiltrates it to attacker-controlled server via image tag or fetch request. When legitimate privileged user (administrator or developer) views the entity list in Budibase UI, the XSS executes and sends their budibase:auth JWT cookie to the attacker. Attacker extracts the JWT from their exfiltration server logs and uses it in Authorization headers or cookie replay to authenticate as the victim, gaining persistent access to their Budibase account including data access, configuration changes, and potentially code execution via automation features.