EUVD-2026-57394
GHSA-q6x4-v3qx-85qw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network stacked-query SQLi with low complexity; PR:L because an attacker typically needs access to a MySQL-bound app, UI:N since the injection itself needs no interaction, S:C as impact hits the separate database.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.
AnalysisAI
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked SQL statements against connected databases because the MySQL driver is instantiated with multipleStatements: true. Malicious input submitted through Budibase app fields bound to a MySQL datasource is passed to the backend database, enabling full read/write/destroy access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a Budibase deployment running a version prior to 3.40.0, and (2) at least one datasource configured as a MySQL integration - the vulnerable multipleStatements: true setting only applies to MySQL connections, so deployments without a MySQL datasource are not exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The reported CVSS is 9.6 (Critical) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, and the technical impact is genuinely severe: stacked-query SQLi giving full database compromise (data theft, DROP/DELETE destruction, privilege escalation, DoS). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker locates a Budibase app screen (for example a form, search box, or filter) whose query is bound to a MySQL datasource and submits input containing a semicolon-separated second statement such as `'; DROP TABLE users; --`. Because the connection allows multiple statements, the backend MySQL server executes both the legitimate query and the injected command, letting the attacker exfiltrate, alter, or destroy data or escalate database privileges. … |
| Remediation | Vendor-released patch: upgrade to Budibase 3.40.0 or later, which sets multipleStatements: false in the MySQL integration (see https://github.com/Budibase/budibase/releases/tag/3.40.0 and advisory https://github.com/Budibase/budibase/security/advisories/GHSA-q6x4-v3qx-85qw). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Disable or isolate all MySQL integrations in Budibase installations; review database access logs for suspicious activity over the past 30 days. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an
Authentication bypass in Budibase low-code platform (versions prior to 3.35.4) allows remote unauthenticated attackers t
Remote code execution in Budibase versions prior to 3.33.4 allows unauthenticated attackers to execute arbitrary Bash co
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today