Security: Budibase/budibase
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
SSRF via User-Controlled queryId in Automation Execute Query StepGHSA-6964-pp88-6wp9 published
May 21, 2026 by mjashanksModerate -
SSRF Blacklist Bypass via Unvalidated HTTP Redirect Following in REST DatasourceGHSA-86f3-cqpq-wp9m published
May 12, 2026 by mjashanksModerate -
NoSQL Injection via JSON Parameter Interpolation in MongoDB Query ExecutionGHSA-qw6m-8fw2-2v64 published
Jul 22, 2026 by mjashanksHigh -
Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase WorkerGHSA-wxq7-x3qp-vcr8 published
May 21, 2026 by mjashanksModerate -
PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment SecretsGHSA-pqcr-jmfv-c9cp published
Mar 9, 2026 by mjashanksCritical -
Universal Auth Bypass via Webhook Query Param InjectionGHSA-gw94-hprh-4wj8 published
Mar 9, 2026 by mjashanksCritical -
Stored XSS via unsanitized entity names rendered with {@html} in Builder Command PaletteGHSA-gp5x-2v54-v2q5 published
Apr 2, 2026 by mjashanksHigh -
Unrestricted Upload of File with Dangerous TypeGHSA-82rc-gxrg-v4gf published
May 14, 2026 by mjashanksHigh -
Server-Side Request Forgery via REST Connector with Empty Default BlacklistGHSA-7r9j-r86q-7g45 published
Apr 2, 2026 by mjashanksCritical -
Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation StepGHSA-fcm4-4pj2-m5hf published
Apr 2, 2026 by mjashanksCritical