CVE-2026-25044
CVE-2026-25044 · Budibase: Command Injection in Bash Automation Step
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper sanitization or validation. User input is processed through processStringSync which allows template interpolation, potentially allowing arbitrary command execution. This issue has been patched in version 3.33.4.
CVSS 8.7 · High · EPSS 0.5% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
budibase
- Versions
- < 3.33.4: Affected
No fix published
@budibase/server npm
- Affected ranges
- SEMVER: < 3.33.4
Update to 3.33.4