EUVD-2026-57394
GHSA-q6x4-v3qx-85qw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network stacked-query SQLi with low complexity; PR:L because an attacker typically needs access to a MySQL-bound app, UI:N since the injection itself needs no interaction, S:C as impact hits the separate database.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.
AnalysisAI
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked SQL statements against connected databases because the MySQL driver is instantiated with multipleStatements: true. Malicious input submitted through Budibase app fields bound to a MySQL datasource is passed to the backend database, enabling full read/write/destroy access. A proof-of-concept is published in the GHSA advisory; there is no public exploit identified as being used in active attacks (not in CISA KEV).
Technical ContextAI
The flaw lives in packages/server/src/integrations/mysql.ts (line ~173), where the mysql2 Node.js driver connection is configured with multipleStatements: true. By default the mysql2 driver disables multi-statement execution precisely to blunt SQL injection; Budibase re-enabled it globally for every MySQL datasource. Combined with CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), this means a single injected input can carry a payload such as 1; DROP TABLE sensitive_data; -- and the driver will happily execute both the intended query and the attacker's appended statements. The affected component is cpe:2.3:a:budibase:budibase (the @budibase/server npm package), and the root cause is a driver-level configuration choice rather than a single unsanitized query, so it affects every MySQL datasource in the platform.
RemediationAI
Vendor-released patch: upgrade to Budibase 3.40.0 or later, which sets multipleStatements: false in the MySQL integration (see https://github.com/Budibase/budibase/releases/tag/3.40.0 and advisory https://github.com/Budibase/budibase/security/advisories/GHSA-q6x4-v3qx-85qw). If you cannot upgrade immediately, the advisory recommends temporarily disabling the MySQL integration/datasource (trade-off: any app relying on that datasource stops functioning), restricting the MySQL account Budibase uses to least privilege so a successful injection cannot DROP tables, grant privileges, or use SELECT INTO OUTFILE (trade-off: legitimate write operations may break and this does not stop data theft via SELECT), and placing a WAF in front of Budibase to filter obvious stacked-query payloads (trade-off: WAF signatures are bypassable and offer only partial coverage). Upgrading is the only complete fix.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaS
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Unauthenticated account takeover of pending invited users in Budibase Server (@budibase/server) versions 3.41.0 through
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today