# CVE-2026-73300: Budibase SQL injection in MySQL integration via multipleStatements

Source: https://junglewise.ai/threats/cve-2026-73300-budibase-sql-injection-in-mysql-integration-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73300 · Severity: low · CVSS 3.1 · Published 2026-07-24

Budibase is a low-code application development platform that uses MySQL databases to store application data. A critical SQL injection vulnerability in its MySQL integration allows attackers to execute arbitrary SQL commands and compromise the entire database, potentially exposing or destroying customer data and disrupting business operations.

Technologies: [@budibase/server (npm)](https://junglewise.ai/threats/technologies/budibase-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-73300 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73300 being exploited in the wild.

**How severe is CVE-2026-73300?** Low severity, with a CVSS score of 3.1, published 24 July 2026.

**Which products and versions are affected?** @budibase/server (npm) SEMVER:introduced=0,last_affected=3.38.1.

**Is there a fix for CVE-2026-73300?** A patch was published on 2026-07-24: patched in version 3.40.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73300 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73300?** Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a SQL injection vulnerability (CWE-89) in Budibase's MySQL integration component located in packages/server/src/integrations/mysql.ts. The root cause is the `multipleStatements: true` configuration setting in the MySQL connection, which allows multiple SQL statements to be executed in a single query. Attackers can inject malicious SQL commands through user input fields in Budibase applications. The vulnerability requires user interaction (UI:R) and is network-reachable. Exploitation enables complete database compromise including data destruction, data exfiltration, privilege escalation, and denial of service. A patch is available in version 3.40.0 that disables the `multipleStatements` setting.

## Affected products

- Budibase Budibase Server <3.40.0

## Identifiers

- CVE-2026-73300
- GHSA-q6x4-v3qx-85qw

## Timeline

- 2026-07-24: disclosed
- 2026-07-24: patched: patched in version 3.40.0

## References

- [https://github.com/Budibase/budibase/security/advisories/GHSA-q6x4-v3qx-85qw](https://github.com/Budibase/budibase/security/advisories/GHSA-q6x4-v3qx-85qw)

## Related threats

- [Budibase S3 signed upload URL issuance via attachments endpoint](https://junglewise.ai/threats/cve-2026-54356-budibase-s3-signed-upload-url-issuance-via-attachments-endpoint)
- [Budibase automation SSRF in webhook and integration steps](https://junglewise.ai/threats/cve-2026-35219-budibase-automation-ssrf-in-webhook-and-integration-steps)
- [Budibase S3 presigned URL authorization regression](https://junglewise.ai/threats/cve-2026-72859-budibase-s3-presigned-url-authorization-regression)
- [Budibase MySQL DESCRIBE backtick injection via multipleStatements](https://junglewise.ai/threats/cve-2026-73408-budibase-mysql-describe-backtick-injection-via-multiplestatements)
- [Budibase privilege escalation in public role assignment API](https://junglewise.ai/threats/cve-2026-73305-budibase-privilege-escalation-in-public-role-assignment-api)