Budibase NoSQL injection in MongoDB query execution

Executive brief

Budibase, a platform for building internal business applications, contains a vulnerability in how it handles MongoDB database queries. An attacker with standard user permissions can bypass security filters to view, modify, or delete sensitive data across the entire database. This could lead to significant data breaches, unauthorized data alteration, or complete loss of business records.

Technical details

A NoSQL injection vulnerability exists in Budibase's MongoDB query execution endpoint (`POST /api/v2/queries/:queryId`). The `enrichContext()` function uses Handlebars with `noEscaping: true` to interpolate user-supplied parameters into JSON query templates, which are then parsed via `JSON.parse()` and passed directly to MongoDB driver methods like `find()` and `deleteMany()`. While the application checks for Handlebars syntax, it fails to sanitize JSON structural characters like quotes and braces. A remote attacker with `QUERY WRITE` permissions can inject NoSQL operators (e.g., `$ne`) to bypass filters and perform unauthorized CRUD operations on arbitrary documents. The vulnerability is addressed in version 3.39.9.

Affected products

• Budibase @budibase/server <= 3.38.1

Timeline

• 2026-07-22: disclosed
• 2026-07-24: advisory: GitHub Advisory published

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D