Executive brief
Budibase is a low-code platform for building internal tools and applications, widely used by organizations to rapidly deploy business applications. This vulnerability allows an attacker with access to database configuration to inject arbitrary system commands that execute with the privileges of the Budibase server process, potentially leading to complete server compromise, data theft, or destruction of systems connected to the database.
Technical details
A command injection vulnerability exists in the PostgreSQL integration module (packages/server/src/integrations/postgres.ts:529-531) where database connection parameters are directly interpolated into shell commands without sanitization. The vulnerable code constructs a pg_dump shell command by concatenating user-controlled configuration values like password, host, and database name into a template string. An attacker with the ability to modify database configuration (through compromised admin credentials or configuration injection) can break out of the command string and execute arbitrary shell commands. The attack requires high privileges (PR:H) as the attacker must have configuration modification capability. A patch is available in version 3.23.32 and later; versions 3.23.22 and earlier are affected.
Affected products
- Budibase @budibase/server <3.23.32
Timeline
- 2026-03-09: disclosed: Advisory published
- 2026-03-09: patched: Fixed in version 3.23.32