Budibase SQL injection in MySQL integration

Executive brief

Budibase is a platform used to build business applications and internal tools. A security flaw in its MySQL database integration allows attackers to run unauthorized database commands. This could lead to the theft of sensitive customer data, the deletion of entire database tables, or a complete shutdown of the application's services.

Technical details

The MySQL integration in Budibase was configured with the 'multipleStatements' option set to true in 'packages/server/src/integrations/mysql.ts'. This configuration allows an attacker to append additional, malicious SQL statements to a legitimate query via unsanitized user input fields. By exploiting this, a remote attacker can achieve full database compromise, including data exfiltration, data destruction (e.g., DROP TABLE), and privilege escalation. The vulnerability is addressed by setting 'multipleStatements' to false.

Affected products

• Budibase Budibase <= 3.38.1

Timeline

• 2026-07-22: disclosed: Advisory published by reporter mjashanks
• 2026-07-24: advisory: GitHub Advisory reviewed and published

References

• https://api.github.com/users/kaimandalic
• https://github.com/kaimandalic
• https://api.github.com/users/kaimandalic/gists%7B/gist_id%7D
• https://api.github.com/users/kaimandalic/repos
• https://avatars.githubusercontent.com/u/204785446?v=4
• https://api.github.com/users/kaimandalic/events%7B/privacy%7D