p PatchFirst

PatchFirst · Latest vulnerabilities

@budibase/server 2.20.0: known vulnerabilities · Page 3

Known vulnerabilities affecting @budibase/server 2.20.0: 41. Compare the fixes below with your installed release.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 41

  1. CVE-2026-25041

    High · CVSS 8.6EPSS 0.5%Fix available

    Budibase has a Command Injection in PostgreSQL Dump Command

    Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.23.22 and earlier, the PostgreSQL integration constructs shell commands using user-controlled configuration values (database name, host, password, etc.) without proper sanitization. The password and other connection parameters are directly interpolated into a shell command. This affects packages/server/src/integrations/postgres.ts.

    @budibase/serverNode.js
    • Update to 3.23.32
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →