Most recent entries from all

EUVD-2026-322252

fkie_cve-2026-45719

Budibase is an open-source low-code platform. Prior to 3.38.1, the V1 Views API (POST /api/views) accepts a calculation parameter from the request body that is interpolated directly into a CouchDB reduce function definition without validation. Although an internal SCHEMA_MAP object defines the valid calculation types (sum, count, stats), no actual validation is performed against this map before the value is used in string interpolation. A user with Builder permissions can inject arbitrary JavaScript code that will be executed within the CouchDB JavaScript engine when the view is queried. This vulnerability is fixed in 3.38.1.

GHSA-363w-hvwh-w7m6 — Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API

Affected: npm: @budibase/server

# Security Advisory: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API

**Affected Software:** Budibase **Affected Component:** `packages/server/src/api/controllers/view/viewBuilder.ts`, `packages/server/src/api/routes/view.ts` **CWE:** CWE-94 (Improper Control of Generation of Code) **Discovery Date:** 2026-03-24

---

## Summary

The V1 Views API (`POST /api/views`) accepts a `calculation` parameter from the request body that is interpolated directly into a CouchDB reduce function definition without validation. Although an internal `SCHEMA_MAP` object defines the valid calculation types (`sum`, `count`, `stats`), no actual validation is performed against this map before the value is used in string interpolation.

A user with Builder permissions can inject arbitrary JavaScript code that will be executed within the CouchDB JavaScript engine when the view is queried.

---

## Affected Component

**Route:** `POST /api/views` (V1 legacy views endpoint) **File:** `packages/server/src/api/routes/view.ts`, line 45

```js .post("/api/views", viewController.v1.save) ```

Note: This route has no Joi request body validator, unlike the V2 views endpoint which uses `viewValidator()`.

**Vulnerable code:** `packages/server/src/api/controllers/view/viewBuilder.ts`, line 213

```js const reduction = field && calculation ? { reduce: `_${calculation}` } : {}

return { meta: { field, tableId, groupBy, filters, schema, calculation, ... }, map: `function (doc) {…

WID-SEC-W-2026-1477 — Budibase: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Code auszuführen oder seine Rechte zu erweitern.