# CVE-2026-27702: Budibase remote code execution via unsafe eval in view filters

Source: https://junglewise.ai/threats/cve-2026-27702-budibase-remote-code-execution-via-unsafe-eval-in-view-filters  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-27702 · Severity: low · CVSS 3.1 · Published 2026-02-25

Budibase Cloud is a low-code application platform that allows users to build web applications through a graphical interface. An authenticated attacker can inject arbitrary JavaScript code through table view filter settings, causing the server to execute malicious commands with full platform privileges. This exposes sensitive credentials (database passwords, API keys, JWT secrets) and allows attackers to access all tenant databases and customer data across the entire Budibase Cloud platform.

Technologies: [budibase (npm)](https://junglewise.ai/threats/technologies/budibase). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-27702 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27702 being exploited in the wild.

**How severe is CVE-2026-27702?** Low severity, with a CVSS score of 3.1, published 25 February 2026.

**Which products and versions are affected?** budibase (npm) SEMVER:introduced=0,fixed=3.30.4.

**Is there a fix for CVE-2026-27702?** Yes. budibase (npm): upgrade to 3.30.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27702 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-27702?** Check whether you run budibase (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- budibase (npm): upgrade to 3.30.4 or later

  ```sh
  npm install budibase@3.30.4
  ```


## Technical details

The vulnerability is an unsafe eval() in packages/server/src/db/inMemoryView.ts where user-supplied view filter values are concatenated directly into a JavaScript string and evaluated without sanitization. An authenticated attacker can break out of the intended filter expression context by injecting JavaScript code that closes the string boundary and uses the OR operator to execute arbitrary statements. The vulnerability only affects Budibase Cloud (SaaS); self-hosted deployments are unaffected because they use native CouchDB design documents instead of in-memory evaluation. Exploitation requires only basic authentication (including free tier accounts) and network access to the cloud platform. A successful exploit grants full Node.js server-side code execution with access to environment variables containing database credentials, API keys, and encryption secrets, enabling enumeration and read/write access to all 489,827+ tenant databases.

## Affected products

- Budibase Budibase <= 3.30.3

## Identifiers

- CVE-2026-27702
- GHSA-rvhr-26g4-p2r8

## Timeline

- 2026-02-25: disclosed
- 2026-02-23: exploited: Verified exploitation on production Budibase Cloud account

## References

- [https://github.com/Budibase/budibase/security/advisories/GHSA-rvhr-26g4-p2r8](https://github.com/Budibase/budibase/security/advisories/GHSA-rvhr-26g4-p2r8)

## Related threats

- [Budibase database connector SQL injection in PostgreSQL, MS SQL, and MySQL](https://junglewise.ai/threats/cve-2026-64657-budibase-database-connector-sql-injection-in-postgresql-ms-sql)
- [Budibase SSRF in executeQuery automation step](https://junglewise.ai/threats/cve-2026-48128-budibase-ssrf-in-executequery-automation-step)
- [Budibase unrestricted file upload leading to stored XSS](https://junglewise.ai/threats/cve-2026-46426-budibase-unrestricted-file-upload-leading-to-stored-xss)
- [Budibase authorization bypass in row action trigger](https://junglewise.ai/threats/cve-2026-45718-budibase-authorization-bypass-in-row-action-trigger)
- [Budibase SSRF via URL validation bypass in Plugin upload](https://junglewise.ai/threats/cve-2026-45061-budibase-ssrf-via-url-validation-bypass-in-plugin-upload)