Executive brief
Budibase Cloud is a low-code application platform that allows users to build web applications through a graphical interface. An authenticated attacker can inject arbitrary JavaScript code through table view filter settings, causing the server to execute malicious commands with full platform privileges. This exposes sensitive credentials (database passwords, API keys, JWT secrets) and allows attackers to access all tenant databases and customer data across the entire Budibase Cloud platform.
Technical details
The vulnerability is an unsafe eval() in packages/server/src/db/inMemoryView.ts where user-supplied view filter values are concatenated directly into a JavaScript string and evaluated without sanitization. An authenticated attacker can break out of the intended filter expression context by injecting JavaScript code that closes the string boundary and uses the OR operator to execute arbitrary statements. The vulnerability only affects Budibase Cloud (SaaS); self-hosted deployments are unaffected because they use native CouchDB design documents instead of in-memory evaluation. Exploitation requires only basic authentication (including free tier accounts) and network access to the cloud platform. A successful exploit grants full Node.js server-side code execution with access to environment variables containing database credentials, API keys, and encryption secrets, enabling enumeration and read/write access to all 489,827+ tenant databases.
Affected products
- Budibase Budibase <= 3.30.3
Timeline
- 2026-02-25: disclosed
- 2026-02-23: exploited: Verified exploitation on production Budibase Cloud account