CVE-2026-82244
9.4
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Summary
Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers to exfiltrate environment variables and credentials with root privileges in default deployments.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| budibase | server | 0 < 3.41.3 | affected |
| budibase | server | 3.41.3 | unaffected |
Weaknesses
- CWE-94: Improper Control of Generation of Code ('Code Injection')
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: no
- Technical Impact: total
References
- https://github.com/Budibase/budibase/security/advisories/GHSA-gwr2-pgg3-p7xp
- https://www.vulncheck.com/advisories/budibase-before-3.41.3-remote-code-execution-via-plugin-eval
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.