EUVD-2026-60379Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Budibase is network-accessible (AV:N), exploitation is straightforward with no race or timing conditions (AC:L), administrator credentials are mandatory (PR:H), save or test action required (UI:R), and SQL injection crosses into the PostgreSQL database as a separate security scope (S:C) enabling full C/I/A impact there.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator who saves or tests the datasource to execute arbitrary SQL through the simple query protocol. This issue is fixed in version 3.39.19.
Articles & Coverage 1
AnalysisAI
SQL injection in Budibase's PostgreSQL datasource connector allows an authenticated administrator to execute arbitrary DDL and DML statements against the connected PostgreSQL database by supplying a crafted schema name containing embedded double quotes. The vulnerable code in packages/server/src/integrations/postgres.ts interpolates the schema field directly into a SET search_path statement using the simple query protocol, which permits semicolon-delimited multi-statement execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Budibase administrator account - the highest privilege tier within the platform (CVSS PR:H). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.4 score is driven primarily by the scope change (S:C) reflecting that injected SQL executes in the PostgreSQL database context - a separate security domain with data potentially far beyond Budibase's own schema. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious Budibase administrator navigates to the PostgreSQL datasource configuration panel and sets the schema field to public"; CREATE TABLE exfil AS SELECT usename, passwd FROM pg_shadow; --. Upon saving or testing the datasource, Budibase constructs SET search_path TO "public"; CREATE TABLE exfil AS SELECT usename, passwd FROM pg_shadow; -- and passes it to node-postgres via the simple query protocol, causing PostgreSQL to execute both statements. … |
| Remediation | Upgrade Budibase to version 3.39.19 or later, which is the vendor-released patch for this vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all Budibase deployments to identify installed versions and document connected PostgreSQL systems containing sensitive data; review administrator activity logs for suspicious schema-related queries. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today