CVE-2026-25044 | THREATINT

Description

Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper sanitization or validation. User input is processed through processStringSync which allows template interpolation, potentially allowing arbitrary command execution. This issue has been patched in version 3.33.4.

PUBLISHED Reserved 2026-01-28 | Published 2026-04-03 | Updated 2026-04-03 | Assigner GitHub_M

HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

< 3.33.4

affected

References

github.com/...dibase/security/advisories/GHSA-gjw9-34gf-rp6m

github.com/Budibase/budibase/releases/tag/3.33.2

cve.org (CVE-2026-25044)

nvd.nist.gov (CVE-2026-25044)

Download JSON