Executive brief
Budibase is an open-source internal tools and low-code platform that allows administrators to build applications. An authenticated admin user can upload a malicious plugin file that triggers arbitrary code execution on the server with full system privileges (including root in default deployments). This enables attackers to steal all stored credentials, encryption keys, and system access to compromise the entire infrastructure.
Technical details
The vulnerability is a code injection flaw (CWE-94, CWE-95) in Budibase's plugin handling system. When a plugin tarball is uploaded, the server extracts and calls eval() on JavaScript files within the main Node.js process without any sandboxing or input validation. An authenticated admin user can craft a malicious plugin that executes arbitrary Node.js code during upload, including spawning shell commands via execSync() to exfiltrate environment variables containing database credentials, JWT secrets, API keys, and encryption keys. The attack requires admin-level authentication but no user interaction or outbound network access; stolen data is returned via the plugin metadata API response. Patch version 3.41.3 is available.
Affected products
- Budibase Budibase before 3.41.3
Timeline
- 2026-08-14: disclosed
- 2026-08-28: advisory
- 2026-08-14: patched: version 3.41.3 released