Most recent entries from all

EUVD-2026-280194

fkie_cve-2026-25044

Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper sanitization or validation. User input is processed through processStringSync which allows template interpolation, potentially allowing arbitrary command execution. This issue has been patched in version 3.33.4.

GHSA-gjw9-34gf-rp6m — Budibase: Command Injection in Bash Automation Step

Affected: npm: @budibase/server

**Location**: `packages/server/src/automations/steps/bash.ts`

#### Description The bash automation step executes user-provided commands using `execSync` without proper sanitization or validation. User input is processed through `processStringSync` which allows template interpolation, potentially allowing arbitrary command execution.

#### Code Reference ```21:28:packages/server/src/automations/steps/bash.ts const command = processStringSync(inputs.code, context)

let stdout, success = true try { stdout = execSync(command, { timeout: environment.QUERY_THREAD_TIMEOUT, }).toString() ```

#### Attack Vector An attacker with access to create or modify automations can inject malicious shell commands by including template syntax that evaluates to command injection payloads (e.g., `$(rm -rf /)`, `; malicious-command`, `| malicious-command`).

#### Impact - Remote code execution (RCE) - Complete system compromise - Data exfiltration - Lateral movement within the infrastructure

#### Recommendation 1. **Immediate**: Disable bash automation step in production until fixed 2. Implement a whitelist of allowed commands 3. Use parameterized command execution with proper escaping 4. Implement command argument validation 5. Consider using a restricted shell or command sandboxing 6. Add rate limiting and monitoring for command execution

#### Example Fix ```typescript import { spawn } from "child_process"

// Validate against whitelist const ALLOWED_COM…

WID-SEC-W-2026-0990 — Budibase: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um beliebigen Code auszuführen – sogar mit Root-Rechten –, sich erweiterte Rechte zu verschaffen – sogar Administratorrechte –, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, einen Denial-of-Service-Zustand herbeizuführen oder vertrauliche Informationen offenzulegen.