Executive brief
Budibase is an open-source platform used by businesses to build internal tools and automate workflows. A security vulnerability in self-hosted versions allows an unauthenticated attacker to execute malicious commands on the server by sending a specially crafted request to a public webhook. If exploited, an attacker could gain full control over the server with root privileges, potentially leading to data theft, service disruption, or further network compromise.
Technical details
A command injection vulnerability (CWE-78) exists in the Bash automation step of self-hosted Budibase instances. The vulnerability is located in 'packages/server/src/automations/steps/bash.ts', where the 'processStringSync' function uses Handlebars to process templates from webhook inputs and passes the result directly to 'execSync'. Because the webhook trigger endpoint ('/api/webhooks/trigger/:instance/:id') lacks authentication, an attacker can send a POST request containing a malicious payload that is substituted into a Bash step. If an administrator has configured an automation with a Bash step using trigger templates, the attacker's payload executes as root within the container. The issue is mitigated in version 3.33.4 by replacing 'execSync' with 'execa' to reduce shell injection risks.
Affected products
- Budibase Budibase < 3.33.4
Timeline
- 2026-03-13: patched: Fix merged in PR #18238 and released in 3.33.4
- 2026-04-02: advisory: GitHub Security Advisory GHSA-fcm4-4pj2-m5hf published
- 2026-04-03: disclosed: NVD publication date