Budibase NoSQL injection in MongoDB integration

Executive brief

A vulnerability in Budibase's MongoDB integration allows regular application users to bypass security filters set by developers. This means a user who should only see their own data could potentially view, modify, or delete all records in the connected MongoDB database. In some cases, this could also allow an attacker to execute unauthorized code on the database server.

Technical details

A NoSQL injection vulnerability exists in Budibase's MongoDB connector due to unsafe Handlebars enrichment of query JSON. When processing queries, the server uses 'noEscaping: true' during string enrichment and then performs a 'JSON.parse()' on the result, allowing an attacker to inject MongoDB operators (like $ne, $where, or $lookup) by breaking out of JSON string literals. Because MongoDB queries are not parameterized like SQL queries in Budibase, an authenticated user with basic access can override developer-defined filters. This can lead to full collection dumps, cross-collection pivots, arbitrary JavaScript execution via the $where operator, or unauthorized bulk updates and deletes.

Affected products

• Budibase Budibase <= 3.38.1

Timeline

• 2026-07-22: advisory: GitHub Advisory published

References

• https://api.github.com/users/adrgs
• https://github.com/adrgs
• https://api.github.com/users/adrgs/gists%7B/gist_id%7D
• https://api.github.com/users/adrgs/repos
• https://avatars.githubusercontent.com/u/11564377?v=4
• https://api.github.com/users/adrgs/events%7B/privacy%7D