EUVD-2026-60379Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Budibase is network-accessible (AV:N), exploitation is straightforward with no race or timing conditions (AC:L), administrator credentials are mandatory (PR:H), save or test action required (UI:R), and SQL injection crosses into the PostgreSQL database as a separate security scope (S:C) enabling full C/I/A impact there.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator who saves or tests the datasource to execute arbitrary SQL through the simple query protocol. This issue is fixed in version 3.39.19.
Articles & Coverage 1
AnalysisAI
SQL injection in Budibase's PostgreSQL datasource connector allows an authenticated administrator to execute arbitrary DDL and DML statements against the connected PostgreSQL database by supplying a crafted schema name containing embedded double quotes. The vulnerable code in packages/server/src/integrations/postgres.ts interpolates the schema field directly into a SET search_path statement using the simple query protocol, which permits semicolon-delimited multi-statement execution. Impact includes full database read and write access - including extraction of pg_shadow password hashes and potential OS-level file reads via pg_read_file(). No public exploit or CISA KEV listing identified at time of analysis; however, the GHSA advisory provides a complete, step-by-step reproduction procedure making this trivially reproducible. Fixed in version 3.39.19.
Technical ContextAI
Budibase's PostgreSQL integration uses the node-postgres (pg) library. The vulnerable path (packages/server/src/integrations/postgres.ts, lines 355-358) splits the user-controlled schema config field on commas and wraps each token in double quotes without escaping embedded double quotes, then passes the resulting string to client.query() as a raw SQL string. The node-postgres client.query() method invoked with a plain string uses the PostgreSQL simple query protocol, which - unlike the extended query protocol used for parameterized statements - permits multiple semicolon-separated statements in a single call. This is the mechanism that enables statement stacking. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) is the root cause: user-controlled data from the schema configuration field flows into a raw SQL identifier position without sanitization. The fix introduced in 3.39.19 adds a quotePostgresIdentifier utility that doubles embedded double quotes (replacing each " with ""), conforming to PostgreSQL's standard double-quoted identifier escaping rules. The same GHSA advisory (GHSA-qqf5-x7mj-v43p) also covers related SQL injection issues in the MS SQL Server and MySQL connectors, though CVE-2026-64657 is scoped specifically to the PostgreSQL connector.
RemediationAI
Upgrade Budibase to version 3.39.19 or later, which is the vendor-released patch for this vulnerability. The fix is implemented in commit 67572a82c3850964f388bfd969779dc025a80224 (https://github.com/Budibase/budibase/commit/67572a82c3850964f388bfd969779dc025a80224) and replaces the unsafe identifier wrapping with the quotePostgresIdentifier utility that properly doubles embedded double quotes. Full advisory is at https://github.com/Budibase/budibase/security/advisories/GHSA-qqf5-x7mj-v43p. As a compensating control prior to patching, restrict Budibase administrator access to the minimum necessary set of trusted personnel and audit all existing PostgreSQL datasource schema configuration fields for anomalous values - specifically any values containing double quotes, semicolons, or SQL keywords. Note that restricting admin access is not a complete mitigation in environments where insider threat is a concern; patching is the only definitive fix. If the PostgreSQL database user provisioned for Budibase datasources holds DDL privileges (CREATE TABLE, DROP TABLE), consider reducing those to the minimum necessary read/write DML permissions as a defense-in-depth measure to limit the blast radius of successful exploitation.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today