# CVE-2026-64657: Budibase database connector SQL injection in PostgreSQL, MS SQL, and MySQL

Source: https://junglewise.ai/threats/cve-2026-64657-budibase-database-connector-sql-injection-in-postgresql-ms-sql  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-64657 · Severity: low · CVSS 3.1 · Published 2026-06-18

Budibase is a low-code platform for building business applications and automations. The database connector feature allows administrators to query PostgreSQL, Microsoft SQL Server, and MySQL databases directly. Due to improper input sanitization, an authenticated administrator can inject arbitrary SQL commands by manipulating database schema configuration fields, leading to full database compromise, credential theft, or OS command execution.

Technologies: [budibase (npm)](https://junglewise.ai/threats/technologies/budibase). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-64657 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64657 being exploited in the wild.

**How severe is CVE-2026-64657?** Low severity, with a CVSS score of 3.1, published 18 June 2026.

**Which products and versions are affected?** budibase (npm) SEMVER:introduced=0,fixed=3.39.19.

**Is there a fix for CVE-2026-64657?** Yes. budibase (npm): upgrade to 3.39.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-64657 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-64657?** Check whether you run budibase (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- budibase (npm): upgrade to 3.39.19 or later

  ```sh
  npm install budibase@3.39.19
  ```


## Technical details

Three distinct SQL injection vulnerabilities exist in Budibase's database connectors (CWE-89). In PostgreSQL, the schema configuration is interpolated directly into a SET search_path query without escaping double-quote characters, allowing an attacker to break the string literal and inject arbitrary SQL via the simple query protocol. In MS SQL Server, schema and table names are interpolated into INFORMATION_SCHEMA queries using single quotes with no escaping, enabling arbitrary SQL and potentially OS command execution via xp_cmdshell. In MySQL, multipleStatements is enabled and table names are wrapped in unescaped backticks, allowing secondary statement injection during schema introspection. All three require authentication as an administrator with datasource configuration access, and user interaction (triggering connection test or schema introspection). Patches are available in version 3.39.19 and later.

## Affected products

- Budibase budibase <3.39.19

## Identifiers

- CVE-2026-64657
- GHSA-qqf5-x7mj-v43p

## Timeline

- 2026-06-18: disclosed: GHSA-qqf5-x7mj-v43p published
- 2026-06-18: patched: Fixed in version 3.39.19

## References

- [https://github.com/Budibase/budibase/security/advisories/GHSA-qqf5-x7mj-v43p](https://github.com/Budibase/budibase/security/advisories/GHSA-qqf5-x7mj-v43p)
- [https://github.com/Budibase/budibase](https://github.com/Budibase/budibase)

## Related threats

- [Budibase SSRF in executeQuery automation step](https://junglewise.ai/threats/cve-2026-48128-budibase-ssrf-in-executequery-automation-step)
- [Budibase unrestricted file upload leading to stored XSS](https://junglewise.ai/threats/cve-2026-46426-budibase-unrestricted-file-upload-leading-to-stored-xss)
- [Budibase authorization bypass in row action trigger](https://junglewise.ai/threats/cve-2026-45718-budibase-authorization-bypass-in-row-action-trigger)
- [Budibase SSRF via URL validation bypass in Plugin upload](https://junglewise.ai/threats/cve-2026-45061-budibase-ssrf-via-url-validation-bypass-in-plugin-upload)
- [Budibase unrestricted SSRF in REST datasource query preview](https://junglewise.ai/threats/cve-2026-33226-budibase-unrestricted-ssrf-in-rest-datasource-query-preview)