Quick answers
- Is CVE-2026-73300 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-73300 being exploited in the wild.
- How severe is CVE-2026-73300?
- Low severity, with a CVSS score of 3.1, published 24 July 2026.
- Which products and versions are affected?
- @budibase/server (npm) SEMVER:introduced=0,last_affected=3.38.1.
- Is there a fix for CVE-2026-73300?
- A patch was published on 2026-07-24: patched in version 3.40.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-73300 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-73300?
- Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a SQL injection vulnerability (CWE-89) in Budibase's MySQL integration component located in packages/server/src/integrations/mysql.ts. The root cause is the `multipleStatements: true` configuration setting in the MySQL connection, which allows multiple SQL statements to be executed in a single query. Attackers can inject malicious SQL commands through user input fields in Budibase applications. The vulnerability requires user interaction (UI:R) and is network-reachable. Exploitation enables complete database compromise including data destruction, data exfiltration, privilege escalation, and denial of service. A patch is available in version 3.40.0 that disables the `multipleStatements` setting.
Affected products
- Budibase Budibase Server <3.40.0
Identifiers
- CVE-2026-73300
- GHSA-q6x4-v3qx-85qw
Timeline
- 2026-07-24: disclosed
- 2026-07-24: patched: patched in version 3.40.0