Is CVE-2026-35216 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35216 being exploited in the wild.

How severe is CVE-2026-35216?

Critical severity, with a CVSS score of 9, published 3 April 2026.

Which products and versions are affected?

@budibase/server (npm) SEMVER:introduced=0,fixed=3.33.4.

Is there a fix for CVE-2026-35216?

Yes. @budibase/server (npm): upgrade to 3.33.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35216 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-35216?

Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35216: Budibase OS command injection in Bash automation step

CVE-2026-35216 · Severity: critical · CVSS 9 · Published 2026-04-03

Budibase is an open-source platform used by businesses to build internal tools and automate workflows. A security vulnerability in self-hosted versions allows an unauthenticated attacker to execute malicious commands on the server by sending a specially crafted request to a public webhook. If exploited, an attacker could gain full control over the server with root privileges, potentially leading to data theft, service disruption, or further network compromise.

Technologies: @budibase/server (npm). Vendors: npm.

Quick answers

Is CVE-2026-35216 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35216 being exploited in the wild.
How severe is CVE-2026-35216?: Critical severity, with a CVSS score of 9, published 3 April 2026.
Which products and versions are affected?: @budibase/server (npm) SEMVER:introduced=0,fixed=3.33.4.
Is there a fix for CVE-2026-35216?: Yes. @budibase/server (npm): upgrade to 3.33.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35216 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-35216?: Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@budibase/server (npm): upgrade to 3.33.4 or later
```
npm install @budibase/server@3.33.4
```

Technical details

A command injection vulnerability (CWE-78) exists in the Bash automation step of self-hosted Budibase instances. The vulnerability is located in 'packages/server/src/automations/steps/bash.ts', where the 'processStringSync' function uses Handlebars to process templates from webhook inputs and passes the result directly to 'execSync'. Because the webhook trigger endpoint ('/api/webhooks/trigger/:instance/:id') lacks authentication, an attacker can send a POST request containing a malicious payload that is substituted into a Bash step. If an administrator has configured an automation with a Bash step using trigger templates, the attacker's payload executes as root within the container. The issue is mitigated in version 3.33.4 by replacing 'execSync' with 'execa' to reduce shell injection risks.

Affected products

Budibase Budibase < 3.33.4

Identifiers

CVE-2026-35216
GHSA-fcm4-4pj2-m5hf

Timeline

2026-03-13: patched: Fix merged in PR #18238 and released in 3.33.4
2026-04-02: advisory: GitHub Security Advisory GHSA-fcm4-4pj2-m5hf published
2026-04-03: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.