p PatchFirst

PatchFirst · Latest vulnerabilities

@budibase/server 3.39.2: known vulnerabilities

Known vulnerabilities affecting @budibase/server 3.39.2: 5. Compare the fixes below with your installed release.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 5

  1. CVE-2026-35219

    High · CVSS 7.1EPSS 0.46%Fix available

    Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

    Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and packages/server/src/automations/steps/discord.ts use node-fetch on user-provided URLs without the BLACKLIST_IPS enforcement used by the REST integration, allowing an authenticated user to make server-side requests to cloud metadata and internal services. This issue is fixed in version 3.41.3.

    @budibase/serverNode.js
    • Update to 3.41.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-73304

    Medium · CVSS 4.9EPSS 0.48%Fix available

    Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

    Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve the identity-provider credentials of SSO-authenticated users and use the refresh tokens for persistent access to connected services. This issue is fixed in version 3.39.25.

    @budibase/serverNode.js
    • Update to 3.39.25
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-54351

    High · CVSS 8.2EPSS 0.46%Fix available

    Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override

    Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request body into automation execution parameters. A mass assignment vulnerability in externalTrigger() allows an attacker to overwrite the internal appId property by including it in the webhook POST body. When the automation is processed asynchronously (the default path for webhooks without a collect step), the worker executes the attacker-defined automation in the context of the victim's workspace, granting full read/write access to the victim's database. This vulnerability is fixed in 3.39.

    @budibase/serverNode.js
    • Update to 3.39.9
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2026-54350

    Critical · CVSS 10.0EPSS 0.54%Fix available

    Budibase: Anonymous NoSQL operator injection via published-app query templates

    Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection and, where the builder has published a PUBLIC write query, modifies every document of that collection with one HTTP request. enrichContext at packages/server/src/sdk/workspace/queries/queries.ts:121-138 substitutes parameter values into the raw JSON body of a query, then JSON.parses the result. The validator validateQueryInputs at packages/server/src/api/controllers/query/index.ts:61-71 rejects only Hand

    @budibase/serverNode.js
    • Update to 3.39.12
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2026-54352

    Critical · CVSS 9.6EPSS 0.49%Fix available

    Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload

    Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with [email protected] into a temp directory, then for each entry listed in icons.json validates the icon path, opens it, and streams the bytes into MinIO. The resulting object is served back via GET /api/assets/{appId}/pwa/{uuid}.png. [email protected] preserves absolute symlink targets when restoring symlink entries. The icon-source validator at packages/server/src/api/controllers/static/index.ts:259-268 resolves the icon source string against baseDir (path.res

    @budibase/serverNode.js
    • Update to 3.39.9
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →