{"schema_version":1,"title":"@budibase/server (npm) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 61 vulnerabilities in @budibase/server (npm): 0 in the last 7 days and 40 in the last 90 days, 7 of them critical and 0 exploited in the wild. The most recent, CVE-2026-54356, was published on 26 August 2026.","url":"https://junglewise.ai/threats/technologies/budibase-server","json_url":"https://junglewise.ai/threats/technologies/budibase-server.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/budibase-server","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":32,"all_time":61,"critical":7,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":40,"last_365_days":60},"latest":[{"cve":"CVE-2026-54356","cvss":7.1,"epss":0.0035,"slug":"cve-2026-54356-budibase-s3-signed-upload-url-issuance-via-attachments-endpoint","title":"Budibase S3 signed upload URL issuance via attachments endpoint","severity":"high","exploited":false,"published_at":"2026-08-26T14:07:26+00:00","url":"https://junglewise.ai/threats/cve-2026-54356-budibase-s3-signed-upload-url-issuance-via-attachments-endpoint"},{"cve":"CVE-2026-35219","cvss":4,"epss":0.0047,"slug":"cve-2026-35219-budibase-automation-ssrf-in-webhook-and-integration-steps","title":"Budibase automation SSRF in webhook and integration steps","severity":"high","exploited":false,"published_at":"2026-08-14T19:18:47+00:00","url":"https://junglewise.ai/threats/cve-2026-35219-budibase-automation-ssrf-in-webhook-and-integration-steps"},{"cve":"CVE-2026-73408","cvss":7.6,"epss":0.0045,"slug":"cve-2026-73408-budibase-mysql-describe-backtick-injection-via-multiplestatements","title":"Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and ins","severity":"high","exploited":false,"published_at":"2026-08-13T22:17:25.81+00:00","url":"https://junglewise.ai/threats/cve-2026-73408-budibase-mysql-describe-backtick-injection-via-multiplestatements"},{"cve":"CVE-2026-73305","cvss":8.8,"epss":0.0052,"slug":"cve-2026-73305-budibase-privilege-escalation-in-public-role-assignment-api","title":"Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without che","severity":"high","exploited":false,"published_at":"2026-08-13T22:17:25.657+00:00","url":"https://junglewise.ai/threats/cve-2026-73305-budibase-privilege-escalation-in-public-role-assignment-api"},{"cve":"CVE-2026-73304","cvss":4.9,"epss":0.0049,"slug":"cve-2026-73304-budibase-sso-oauth2-token-leakage-via-user-metadata-endpoints","title":"Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user object","severity":"medium","exploited":false,"published_at":"2026-08-13T22:17:25.5+00:00","url":"https://junglewise.ai/threats/cve-2026-73304-budibase-sso-oauth2-token-leakage-via-user-metadata-endpoints"},{"cve":"CVE-2026-73302","cvss":4,"epss":0.0043,"slug":"cve-2026-73302-budibase-oidc-sso-account-takeover-via-unverified-email-claim","title":"Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts r","severity":"medium","exploited":false,"published_at":"2026-08-13T22:17:25.353+00:00","url":"https://junglewise.ai/threats/cve-2026-73302-budibase-oidc-sso-account-takeover-via-unverified-email-claim"},{"cve":"CVE-2026-72855","cvss":8.5,"epss":0.0038,"slug":"cve-2026-72855-budibase-dns-rebinding-ssrf-in-openapi-import-and-rest-execution","title":"Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow auth","severity":"high","exploited":false,"published_at":"2026-08-13T22:17:24.753+00:00","url":"https://junglewise.ai/threats/cve-2026-72855-budibase-dns-rebinding-ssrf-in-openapi-import-and-rest-execution"},{"cve":"CVE-2026-72849","cvss":7.7,"epss":0.0016,"slug":"cve-2026-72849-budibase-chat-link-handoff-identity-confusion-and-account-link","title":"Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind a","severity":"high","exploited":false,"published_at":"2026-08-13T22:17:24.14+00:00","url":"https://junglewise.ai/threats/cve-2026-72849-budibase-chat-link-handoff-identity-confusion-and-account-link"},{"cve":"CVE-2026-73618","cvss":8.3,"epss":0.0051,"slug":"cve-2026-73618-budibase-nosql-injection-in-mongodb-query-execution","title":"Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameter","severity":"high","exploited":false,"published_at":"2026-08-13T12:17:26.77+00:00","url":"https://junglewise.ai/threats/cve-2026-73618-budibase-nosql-injection-in-mongodb-query-execution"},{"cve":"CVE-2026-73617","cvss":7.1,"epss":0.0034,"slug":"cve-2026-73617-budibase-nosql-injection-in-mongodb-integration","title":"Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enr","severity":"high","exploited":false,"published_at":"2026-08-13T12:17:26.627+00:00","url":"https://junglewise.ai/threats/cve-2026-73617-budibase-nosql-injection-in-mongodb-integration"},{"cve":"CVE-2026-73307","cvss":4,"epss":0.0043,"slug":"cve-2026-73307-budibase-ssrf-via-bare-fetch-in-ai-table-generation","title":"Budibase SSRF via bare fetch() in AI table generation","severity":"medium","exploited":false,"published_at":"2026-07-24T21:44:44+00:00","url":"https://junglewise.ai/threats/cve-2026-73307-budibase-ssrf-via-bare-fetch-in-ai-table-generation"},{"cvss":4.9,"slug":"budibase-ssrf-in-ai-table-generation-via-uploadurl-c0b31260","title":"Budibase SSRF in AI table generation via uploadUrl","severity":"medium","exploited":false,"published_at":"2026-07-24T21:44:44+00:00","url":"https://junglewise.ai/threats/budibase-ssrf-in-ai-table-generation-via-uploadurl-c0b31260"},{"cve":"CVE-2026-73410","cvss":3.1,"epss":0.0028,"slug":"cve-2026-73410-budibase-ssrf-via-dns-rebinding-in-rest-datasource","title":"Budibase SSRF via DNS rebinding in REST datasource","severity":"low","exploited":false,"published_at":"2026-07-24T21:44:27+00:00","url":"https://junglewise.ai/threats/cve-2026-73410-budibase-ssrf-via-dns-rebinding-in-rest-datasource"},{"cvss":8.5,"slug":"budibase-ssrf-via-dns-rebinding-in-rest-datasource-integration-ad7eb612","title":"Budibase SSRF via DNS rebinding in REST datasource integration","severity":"high","exploited":false,"published_at":"2026-07-24T21:44:27+00:00","url":"https://junglewise.ai/threats/budibase-ssrf-via-dns-rebinding-in-rest-datasource-integration-ad7eb612"},{"cvss":7.1,"slug":"budibase-nosql-injection-in-mongodb-integration-86119626","title":"Budibase NoSQL injection in MongoDB integration","severity":"high","exploited":false,"published_at":"2026-07-24T21:43:34+00:00","url":"https://junglewise.ai/threats/budibase-nosql-injection-in-mongodb-integration-86119626"},{"cvss":5.3,"slug":"budibase-account-enumeration-via-login-lockout-response-differential-1175d7e3","title":"Budibase account enumeration via login lockout response differential","severity":"medium","exploited":false,"published_at":"2026-07-24T21:43:11+00:00","url":"https://junglewise.ai/threats/budibase-account-enumeration-via-login-lockout-response-differential-1175d7e3"},{"cve":"CVE-2026-73306","cvss":3.1,"epss":0.0044,"slug":"cve-2026-73306-budibase-account-enumeration-via-login-lockout-response","title":"Budibase account enumeration via login lockout response differential","severity":"low","exploited":false,"published_at":"2026-07-24T21:43:11+00:00","url":"https://junglewise.ai/threats/cve-2026-73306-budibase-account-enumeration-via-login-lockout-response"},{"cvss":7.7,"slug":"budibase-account-link-csrf-in-ai-chat-link-handoff-435a36f8","title":"Budibase account-link CSRF in AI chat-link handoff","severity":"high","exploited":false,"published_at":"2026-07-24T21:42:51+00:00","url":"https://junglewise.ai/threats/budibase-account-link-csrf-in-ai-chat-link-handoff-435a36f8"},{"cvss":7.6,"slug":"budibase-sql-injection-in-mysql-database-connector-via-describe-query-a54b7cc1","title":"Budibase SQL injection in MySQL Database Connector via DESCRIBE query","severity":"high","exploited":false,"published_at":"2026-07-24T21:26:19+00:00","url":"https://junglewise.ai/threats/budibase-sql-injection-in-mysql-database-connector-via-describe-query-a54b7cc1"},{"cvss":8.3,"slug":"budibase-nosql-injection-in-mongodb-query-execution-f4689df2","title":"Budibase NoSQL injection in MongoDB query execution","severity":"high","exploited":false,"published_at":"2026-07-24T21:25:51+00:00","url":"https://junglewise.ai/threats/budibase-nosql-injection-in-mongodb-query-execution-f4689df2"},{"cvss":5.7,"slug":"budibase-oauth2-token-disclosure-in-automation-test-results-68cd30d5","title":"Budibase OAuth2 token disclosure in automation test results","severity":"medium","exploited":false,"published_at":"2026-07-24T21:25:20+00:00","url":"https://junglewise.ai/threats/budibase-oauth2-token-disclosure-in-automation-test-results-68cd30d5"},{"cve":"CVE-2026-73308","cvss":3.1,"epss":0.0041,"slug":"cve-2026-73308-budibase-oauth2-token-disclosure-in-automation-test-results","title":"Budibase OAuth2 token disclosure in automation test results","severity":"low","exploited":false,"published_at":"2026-07-24T21:25:20+00:00","url":"https://junglewise.ai/threats/cve-2026-73308-budibase-oauth2-token-disclosure-in-automation-test-results"},{"cvss":7.5,"slug":"budibase-information-disclosure-in-tenant-user-lookup-endpoint-25f86844","title":"Budibase information disclosure in tenant user lookup endpoint","severity":"high","exploited":false,"published_at":"2026-07-24T21:25:00+00:00","url":"https://junglewise.ai/threats/budibase-information-disclosure-in-tenant-user-lookup-endpoint-25f86844"},{"cve":"CVE-2026-73406","cvss":3.1,"epss":0.0051,"slug":"cve-2026-73406-budibase-unauthenticated-user-information-disclosure-in-tenant","title":"Budibase unauthenticated user information disclosure in tenant lookup endpoint","severity":"low","exploited":false,"published_at":"2026-07-24T21:25:00+00:00","url":"https://junglewise.ai/threats/cve-2026-73406-budibase-unauthenticated-user-information-disclosure-in-tenant"},{"cve":"CVE-2026-73407","cvss":9.8,"epss":0.0054,"slug":"cve-2026-73407-budibase-rest-datasource-credential-theft-via-cross-origin-auth","title":"Budibase REST datasource credential theft via cross-origin auth leak","severity":"info","exploited":false,"published_at":"2026-07-24T21:22:51+00:00","url":"https://junglewise.ai/threats/cve-2026-73407-budibase-rest-datasource-credential-theft-via-cross-origin-auth"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":3,"exploited":0,"vulnerabilities":30},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":9},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"flowise (npm)","slug":"flowise","vulnerabilities":156,"url":"https://junglewise.ai/threats/technologies/flowise"},{"name":"vm2 (npm)","slug":"vm2","vulnerabilities":83,"url":"https://junglewise.ai/threats/technologies/vm2"},{"name":"directus (npm)","slug":"directus","vulnerabilities":60,"url":"https://junglewise.ai/threats/technologies/directus"},{"name":"nocodb (npm)","slug":"nocodb","vulnerabilities":55,"url":"https://junglewise.ai/threats/technologies/nocodb"},{"name":"hono (npm)","slug":"hono","vulnerabilities":54,"url":"https://junglewise.ai/threats/technologies/hono"},{"name":"parse-server (npm)","slug":"parse-server","vulnerabilities":42,"url":"https://junglewise.ai/threats/technologies/parse-server"},{"name":"dompurify (npm)","slug":"dompurify","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/dompurify"},{"name":"ghost (npm)","slug":"ghost","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/ghost"},{"name":"flowise-components (npm)","slug":"flowise-components","vulnerabilities":35,"url":"https://junglewise.ai/threats/technologies/flowise-components"},{"name":"astro (npm)","slug":"astro","vulnerabilities":30,"url":"https://junglewise.ai/threats/technologies/astro"},{"name":"@anthropic-ai/claude-code (npm)","slug":"anthropic-ai-claude-code","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/anthropic-ai-claude-code"},{"name":"9router (npm)","slug":"9router","vulnerabilities":26,"url":"https://junglewise.ai/threats/technologies/9router"}],"technology":{"hub":true,"name":"@budibase/server (npm)","slug":"budibase-server","vendor":{"name":"npm","slug":"npm","url":"https://junglewise.ai/threats/vendors/npm"},"aliases":[],"homepage":"https://budibase.com/","repo_url":"https://github.com/Budibase/budibase","description":"The server component for Budibase, a low-code platform for building internal business applications.","url":"https://junglewise.ai/threats/technologies/budibase-server"},"most_severe":[{"cve":"CVE-2026-54350","cvss":10,"epss":0.0054,"slug":"cve-2026-54350-budibase-nosql-injection-in-published-app-query-templates","title":"Budibase NoSQL injection in published app query templates","severity":"critical","exploited":false,"published_at":"2026-06-26T21:16:35.04+00:00","url":"https://junglewise.ai/threats/cve-2026-54350-budibase-nosql-injection-in-published-app-query-templates"},{"cvss":9.8,"slug":"budibase-rest-datasource-credential-theft-via-cross-origin-leak-82cdb532","title":"Budibase REST datasource credential theft via cross-origin leak","severity":"critical","exploited":false,"published_at":"2026-07-24T21:22:51+00:00","url":"https://junglewise.ai/threats/budibase-rest-datasource-credential-theft-via-cross-origin-leak-82cdb532"},{"cvss":9.8,"slug":"budibase-oidc-sso-account-takeover-via-unverified-email-linking-194a7c08","title":"Budibase OIDC SSO account takeover via unverified email linking","severity":"critical","exploited":false,"published_at":"2026-07-24T21:17:39+00:00","url":"https://junglewise.ai/threats/budibase-oidc-sso-account-takeover-via-unverified-email-linking-194a7c08"},{"cve":"CVE-2026-54352","cvss":9.6,"epss":0.0049,"slug":"cve-2026-54352-budibase-arbitrary-file-read-via-symlink-following-in-pwa-zip","title":"Budibase arbitrary file read via symlink following in PWA zip upload","severity":"critical","exploited":false,"published_at":"2026-06-26T21:16:35.293+00:00","url":"https://junglewise.ai/threats/cve-2026-54352-budibase-arbitrary-file-read-via-symlink-following-in-pwa-zip"},{"cvss":9.6,"slug":"budibase-sql-injection-in-mysql-integration-810e2ec1","title":"Budibase SQL injection in MySQL integration","severity":"critical","exploited":false,"published_at":"2026-07-24T21:15:02+00:00","url":"https://junglewise.ai/threats/budibase-sql-injection-in-mysql-integration-810e2ec1"},{"cve":"CVE-2026-35216","cvss":9,"epss":0.0117,"slug":"cve-2026-35216-budibase-os-command-injection-in-bash-automation-step","title":"Budibase OS command injection in Bash automation step","severity":"critical","exploited":false,"published_at":"2026-04-03T16:16:41.8+00:00","url":"https://junglewise.ai/threats/cve-2026-35216-budibase-os-command-injection-in-bash-automation-step"},{"cve":"CVE-2026-48150","cvss":9,"epss":0.0047,"slug":"cve-2026-48150-budibase-privilege-escalation-in-roles-assignment-api","title":"Budibase privilege escalation in roles assignment API","severity":"critical","exploited":false,"published_at":"2026-05-27T18:16:27.463+00:00","url":"https://junglewise.ai/threats/cve-2026-48150-budibase-privilege-escalation-in-roles-assignment-api"},{"cve":"CVE-2026-73305","cvss":8.8,"epss":0.0052,"slug":"cve-2026-73305-budibase-privilege-escalation-in-public-role-assignment-api","title":"Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without che","severity":"high","exploited":false,"published_at":"2026-08-13T22:17:25.657+00:00","url":"https://junglewise.ai/threats/cve-2026-73305-budibase-privilege-escalation-in-public-role-assignment-api"},{"cve":"CVE-2026-25044","cvss":8.8,"epss":0.0047,"slug":"cve-2026-25044-budibase-command-injection-in-bash-automation-step","title":"Budibase command injection in bash automation step","severity":"high","exploited":false,"published_at":"2026-04-03T16:16:35.87+00:00","url":"https://junglewise.ai/threats/cve-2026-25044-budibase-command-injection-in-bash-automation-step"},{"cve":"CVE-2026-45717","cvss":8.8,"epss":0.0044,"slug":"cve-2026-45717-budibase-missing-authorization-in-datasource-management-api","title":"Budibase missing authorization in datasource management API","severity":"high","exploited":false,"published_at":"2026-05-27T18:16:25.727+00:00","url":"https://junglewise.ai/threats/cve-2026-45717-budibase-missing-authorization-in-datasource-management-api"}],"generated_at":"2026-09-27T03:07:00.185062+00:00"}