Is CVE-2026-27702 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27702 being exploited in the wild.

How severe is CVE-2026-27702?

Low severity, with a CVSS score of 3.1, published 25 February 2026.

Which products and versions are affected?

budibase (npm) SEMVER:introduced=0,fixed=3.30.4.

Is there a fix for CVE-2026-27702?

Yes. budibase (npm): upgrade to 3.30.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27702 attacked?

It is attacked over the network.

Am I affected by CVE-2026-27702?

Check whether you run budibase (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27702: Budibase remote code execution via unsafe eval in view filters

CVE-2026-27702 · Severity: low · CVSS 3.1 · Published 2026-02-25

Budibase Cloud is a low-code application platform that allows users to build web applications through a graphical interface. An authenticated attacker can inject arbitrary JavaScript code through table view filter settings, causing the server to execute malicious commands with full platform privileges. This exposes sensitive credentials (database passwords, API keys, JWT secrets) and allows attackers to access all tenant databases and customer data across the entire Budibase Cloud platform.

Technologies: budibase (npm). Vendors: npm.

Quick answers

Is CVE-2026-27702 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27702 being exploited in the wild.
How severe is CVE-2026-27702?: Low severity, with a CVSS score of 3.1, published 25 February 2026.
Which products and versions are affected?: budibase (npm) SEMVER:introduced=0,fixed=3.30.4.
Is there a fix for CVE-2026-27702?: Yes. budibase (npm): upgrade to 3.30.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27702 attacked?: It is attacked over the network.
Am I affected by CVE-2026-27702?: Check whether you run budibase (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

budibase (npm): upgrade to 3.30.4 or later
```
npm install budibase@3.30.4
```

Technical details

The vulnerability is an unsafe eval() in packages/server/src/db/inMemoryView.ts where user-supplied view filter values are concatenated directly into a JavaScript string and evaluated without sanitization. An authenticated attacker can break out of the intended filter expression context by injecting JavaScript code that closes the string boundary and uses the OR operator to execute arbitrary statements. The vulnerability only affects Budibase Cloud (SaaS); self-hosted deployments are unaffected because they use native CouchDB design documents instead of in-memory evaluation. Exploitation requires only basic authentication (including free tier accounts) and network access to the cloud platform. A successful exploit grants full Node.js server-side code execution with access to environment variables containing database credentials, API keys, and encryption secrets, enabling enumeration and read/write access to all 489,827+ tenant databases.

Affected products

Budibase Budibase <= 3.30.3

Identifiers

CVE-2026-27702
GHSA-rvhr-26g4-p2r8

Timeline

2026-02-25: disclosed
2026-02-23: exploited: Verified exploitation on production Budibase Cloud account

References

https://github.com/Budibase/budibase/security/advisories/GHSA-rvhr-26g4-p2r8

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.