# @budibase/server (npm) vulnerabilities Source: https://junglewise.ai/threats/technologies/budibase-server Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/budibase-server.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 42 vulnerabilities in @budibase/server (npm): 0 in the last 7 days and 1 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-54356, was published on 26 August 2026. Nothing was published in the last eight weeks. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 1 - All time: 42 (4 critical, 0 exploited in the wild) ## About @budibase/server (npm) Backend server component for Budibase low-code application platform. ## Latest @budibase/server (npm) vulnerabilities - [CVE-2026-54356: Budibase S3 signed upload URL issuance via attachments endpoint](https://junglewise.ai/threats/cve-2026-54356-budibase-s3-signed-upload-url-issuance-via-attachments-endpoint) (high, CVSS 7.1, published 26 Aug 2026) - [CVE-2026-35219: Budibase automation SSRF in webhook and integration steps](https://junglewise.ai/threats/cve-2026-35219-budibase-automation-ssrf-in-webhook-and-integration-steps) (high, CVSS 4, published 14 Aug 2026) - [CVE-2026-72859: Budibase S3 presigned URL authorization regression](https://junglewise.ai/threats/cve-2026-72859-budibase-s3-presigned-url-authorization-regression) (high, CVSS 7.7, published 14 Aug 2026) - [CVE-2026-73408: Budibase MySQL DESCRIBE backtick injection via multipleStatements](https://junglewise.ai/threats/cve-2026-73408-budibase-mysql-describe-backtick-injection-via-multiplestatements) (high, CVSS 7.6, published 13 Aug 2026) - [CVE-2026-73305: Budibase privilege escalation in public role assignment API](https://junglewise.ai/threats/cve-2026-73305-budibase-privilege-escalation-in-public-role-assignment-api) (high, CVSS 8.8, published 13 Aug 2026) - [CVE-2026-73304: Budibase SSO OAuth2 token leakage via user metadata endpoints](https://junglewise.ai/threats/cve-2026-73304-budibase-sso-oauth2-token-leakage-via-user-metadata-endpoints) (medium, CVSS 4.9, published 13 Aug 2026) - [CVE-2026-73302: Budibase OIDC SSO account takeover via unverified email claim](https://junglewise.ai/threats/cve-2026-73302-budibase-oidc-sso-account-takeover-via-unverified-email-claim) (medium, CVSS 4, published 13 Aug 2026) - [CVE-2026-72855: Budibase DNS rebinding SSRF in OpenAPI import and REST execution](https://junglewise.ai/threats/cve-2026-72855-budibase-dns-rebinding-ssrf-in-openapi-import-and-rest-execution) (high, CVSS 8.5, published 13 Aug 2026) - [CVE-2026-72849: Budibase chat-link handoff identity confusion and account-link CSRF](https://junglewise.ai/threats/cve-2026-72849-budibase-chat-link-handoff-identity-confusion-and-account-link) (high, CVSS 7.7, published 13 Aug 2026) - [CVE-2026-73618: Budibase NoSQL injection in MongoDB query execution](https://junglewise.ai/threats/cve-2026-73618-budibase-nosql-injection-in-mongodb-query-execution) (high, CVSS 8.3, published 13 Aug 2026) - [CVE-2026-73617: Budibase NoSQL injection in MongoDB integration](https://junglewise.ai/threats/cve-2026-73617-budibase-nosql-injection-in-mongodb-integration) (high, CVSS 7.1, published 13 Aug 2026) - [CVE-2026-73307: Budibase SSRF via bare fetch() in AI table generation](https://junglewise.ai/threats/cve-2026-73307-budibase-ssrf-via-bare-fetch-in-ai-table-generation) (medium, CVSS 4, published 24 Jul 2026) - [CVE-2026-73410: Budibase SSRF via DNS rebinding in REST datasource](https://junglewise.ai/threats/cve-2026-73410-budibase-ssrf-via-dns-rebinding-in-rest-datasource) (low, CVSS 3.1, published 24 Jul 2026) - [CVE-2026-73306: Budibase account enumeration via login lockout response differential](https://junglewise.ai/threats/cve-2026-73306-budibase-account-enumeration-via-login-lockout-response) (low, CVSS 3.1, published 24 Jul 2026) - [CVE-2026-73308: Budibase OAuth2 token disclosure in automation test results](https://junglewise.ai/threats/cve-2026-73308-budibase-oauth2-token-disclosure-in-automation-test-results) (low, CVSS 3.1, published 24 Jul 2026) - [CVE-2026-73406: Budibase unauthenticated user information disclosure in tenant lookup endpoint](https://junglewise.ai/threats/cve-2026-73406-budibase-unauthenticated-user-information-disclosure-in-tenant) (low, CVSS 3.1, published 24 Jul 2026) - [CVE-2026-73407: Budibase REST datasource credential theft via cross-origin auth leak](https://junglewise.ai/threats/cve-2026-73407-budibase-rest-datasource-credential-theft-via-cross-origin-auth) (info, CVSS 9.8, published 24 Jul 2026) - [CVE-2026-73409: Budibase arbitrary filesystem path read oracle in MongoDB datasource](https://junglewise.ai/threats/cve-2026-73409-budibase-arbitrary-filesystem-path-read-oracle-in-mongodb) (medium, CVSS 4, published 24 Jul 2026) - [CVE-2026-73300: Budibase SQL injection in MySQL integration via multipleStatements](https://junglewise.ai/threats/cve-2026-73300-budibase-sql-injection-in-mysql-integration-via) (low, CVSS 3.1, published 24 Jul 2026) - [CVE-2026-73303: Budibase email change IDOR allows account takeover](https://junglewise.ai/threats/cve-2026-73303-budibase-email-change-idor-allows-account-takeover) (info, CVSS 7.1, published 24 Jul 2026) - [CVE-2026-73301: Budibase missing RBAC on group enumeration endpoint](https://junglewise.ai/threats/cve-2026-73301-budibase-missing-rbac-on-group-enumeration-endpoint) (low, CVSS 3.1, published 24 Jul 2026) - [CVE-2026-54352: Budibase arbitrary file read via symlink following in PWA zip upload](https://junglewise.ai/threats/cve-2026-54352-budibase-arbitrary-file-read-via-symlink-following-in-pwa-zip) (critical, CVSS 9.6, published 26 Jun 2026) - [CVE-2026-54351: Budibase mass assignment in webhook trigger allows cross-workspace execution](https://junglewise.ai/threats/cve-2026-54351-budibase-mass-assignment-in-webhook-trigger-allows-cross) (high, CVSS 8.2, published 26 Jun 2026) - [CVE-2026-54350: Budibase NoSQL injection in published app query templates](https://junglewise.ai/threats/cve-2026-54350-budibase-nosql-injection-in-published-app-query-templates) (critical, CVSS 10, published 26 Jun 2026) - [CVE-2026-50137: Budibase missing authorization in S3 pre-signed URL generation](https://junglewise.ai/threats/cve-2026-50137-budibase-missing-authorization-in-s3-pre-signed-url-generation) (high, CVSS 3.1, published 26 Jun 2026) ## Most severe @budibase/server (npm) vulnerabilities - [CVE-2026-54350: Budibase NoSQL injection in published app query templates](https://junglewise.ai/threats/cve-2026-54350-budibase-nosql-injection-in-published-app-query-templates) (critical, CVSS 10, published 26 Jun 2026) - [CVE-2026-54352: Budibase arbitrary file read via symlink following in PWA zip upload](https://junglewise.ai/threats/cve-2026-54352-budibase-arbitrary-file-read-via-symlink-following-in-pwa-zip) (critical, CVSS 9.6, published 26 Jun 2026) - [CVE-2026-35216: Budibase OS command injection in Bash automation step](https://junglewise.ai/threats/cve-2026-35216-budibase-os-command-injection-in-bash-automation-step) (critical, CVSS 9, published 3 Apr 2026) - [CVE-2026-48150: Budibase privilege escalation in roles assignment API](https://junglewise.ai/threats/cve-2026-48150-budibase-privilege-escalation-in-roles-assignment-api) (critical, CVSS 9, published 27 May 2026) - [CVE-2026-73305: Budibase privilege escalation in public role assignment API](https://junglewise.ai/threats/cve-2026-73305-budibase-privilege-escalation-in-public-role-assignment-api) (high, CVSS 8.8, published 13 Aug 2026) - [CVE-2026-25044: Budibase command injection in bash automation step](https://junglewise.ai/threats/cve-2026-25044-budibase-command-injection-in-bash-automation-step) (high, CVSS 8.8, published 3 Apr 2026) - [CVE-2026-45717: Budibase missing authorization in datasource management API](https://junglewise.ai/threats/cve-2026-45717-budibase-missing-authorization-in-datasource-management-api) (high, CVSS 8.8, published 27 May 2026) - [CVE-2026-35214: Budibase path traversal in plugin upload endpoint](https://junglewise.ai/threats/cve-2026-35214-budibase-path-traversal-in-plugin-upload-endpoint) (high, CVSS 8.7, published 3 Apr 2026) - [CVE-2026-72855: Budibase DNS rebinding SSRF in OpenAPI import and REST execution](https://junglewise.ai/threats/cve-2026-72855-budibase-dns-rebinding-ssrf-in-openapi-import-and-rest-execution) (high, CVSS 8.5, published 13 Aug 2026) - [CVE-2026-48153: Budibase SSRF in OAuth2 SDK fetchToken](https://junglewise.ai/threats/cve-2026-48153-budibase-ssrf-in-oauth2-sdk-fetchtoken) (high, CVSS 8.5, published 27 May 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other npm technologies - [openclaw (npm)](https://junglewise.ai/threats/technologies/npm-openclaw): 214 vulnerabilities - [flowise (npm)](https://junglewise.ai/threats/technologies/flowise): 133 vulnerabilities - [parse-server (npm)](https://junglewise.ai/threats/technologies/parse-server): 117 vulnerabilities - [vm2 (npm)](https://junglewise.ai/threats/technologies/vm2): 111 vulnerabilities - [electron (npm)](https://junglewise.ai/threats/technologies/electron): 77 vulnerabilities - [ghost (npm)](https://junglewise.ai/threats/technologies/ghost): 74 vulnerabilities - [n8n (npm)](https://junglewise.ai/threats/technologies/npm-n8n): 64 vulnerabilities - [hono (npm)](https://junglewise.ai/threats/technologies/hono): 62 vulnerabilities - [directus (npm)](https://junglewise.ai/threats/technologies/directus): 61 vulnerabilities - [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb): 54 vulnerabilities - [undici (npm)](https://junglewise.ai/threats/technologies/undici): 53 vulnerabilities - [apostrophe (npm)](https://junglewise.ai/threats/technologies/apostrophe): 36 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "@budibase/server (npm) vulnerabilities", https://junglewise.ai/threats/technologies/budibase-server, 13 November 2026.