Executive brief
Budibase is a low-code platform for building web applications and automations. The MySQL database connector fails to escape backticks in table names during schema introspection, allowing an attacker with the ability to create tables in the underlying MySQL database to inject arbitrary SQL statements. When a Budibase administrator refreshes the datasource schema, the malicious table name breaks out of the DESCRIBE query and executes attacker-controlled SQL, potentially leading to data theft, modification, or destruction.
Technical details
This is a SQL injection vulnerability (CWE-89) in Budibase's MySQL integration. The vulnerable code in packages/server/src/integrations/mysql.ts enables multipleStatements: true and constructs DESCRIBE queries by interpolating table names from INFORMATION_SCHEMA.TABLES directly into backtick-wrapped identifiers without escaping embedded backticks. An attacker with the ability to create tables in the target MySQL database can create a table with a name like `foo`; DROP TABLE users; --`, which when retrieved during schema introspection and passed to the unescaped DESCRIBE query, causes the backtick to terminate the identifier early and the semicolon-separated payload to execute as a second statement within the same round trip. Attack preconditions require the attacker to have table creation privileges on the MySQL database and requires a Budibase administrator to trigger schema discovery. The vulnerability was patched in version 3.40.0.
Affected products
- Budibase Budibase <3.40.0
Timeline
- 2026-07-24: disclosed
- 2026-06-16: patched: Patch released in version 3.40.0; fix merged in PR #18989
References
- https://github.com/Budibase/budibase/security/advisories/GHSA-2xgg-r2wc-c5r2
- https://github.com/Budibase/budibase/pull/18989
- https://github.com/Budibase/budibase/commit/2c61f389c9986c91ddd8ae161c2b5e8ec21c60ac
- https://github.com/Budibase/budibase
- https://github.com/Budibase/budibase/releases/tag/3.39.18