https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 15:07:43 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-355049 EUVD-2026-355049 https://cve.radiocsirt.org/vuln/euvd-2026-355049 https://cve.radiocsirt.org/vuln/fkie_cve-2026-64657 <p>Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator who saves or tests the datasource to execute arbitrary SQL through the simple query protocol. This issue is fixed in version 3.39.19.</p> <p>Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator who saves or tests the datasource to execute arbitrary SQL through the simple query protocol. This issue is fixed in version 3.39.19.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-64657 https://cve.radiocsirt.org/vuln/ghsa-qqf5-x7mj-v43p <p><strong>Affected:</strong> npm: budibase</p> <p>### Summary This advisory covers three distinct SQL Injection vulnerabilities within Budibase&#39;s database connectors (PostgreSQL, Microsoft SQL Server, and MySQL). Because user-controlled schema and table configurations are interpolated directly into raw SQL queries without proper escaping or parameterization during database introspection, an authenticated administrator can break out of string delimiters. This allows for arbitrary DDL/DML execution, database compromise, and potential underlying OS command execution (e.g., via MS SQL `xp_cmdshell`).</p> <p>### Details</p> <p>### Vulnerability Type &amp; Title **PostgreSQL `SET search_path` SQL Injection**</p> <p>### Description &amp; Root Cause The `schema` datasource config field is interpolated directly into a raw SQL statement without proper escaping. Double quotes inside the schema name are not escaped, allowing an attacker to break out of the string literal and inject arbitrary SQL.</p> <p>**Vulnerable Code:** **File:** `packages/server/src/integrations/postgres.ts`, lines 355–358</p> <p>```typescript const search_path = this.config.schema .split(&#34;,&#34;) .map(item =&gt; `&#34;${item.trim()}&#34;`) // NO escaping of embedded &#34; await this.client.query(`SET search_path TO ${search_path.join(&#34;,&#34;)};`) ```</p> <p>`node-postgres` sends this via the **simple query protocol**, which supports multi-statement execution with semicolons.</p> <p>### Step-by-Step Reproduction 1. Edit a PostgreSQL datasource configuration. 2. Set the schema field to: `public&#34;; CREATE TABLE pwned…</p> <p><strong>Affected:</strong> npm: budibase</p> <p>### Summary This advisory covers three distinct SQL Injection vulnerabilities within Budibase&#39;s database connectors (PostgreSQL, Microsoft SQL Server, and MySQL). Because user-controlled schema and table configurations are interpolated directly into raw SQL queries without proper escaping or parameterization during database introspection, an authenticated administrator can break out of string delimiters. This allows for arbitrary DDL/DML execution, database compromise, and potential underlying OS command execution (e.g., via MS SQL `xp_cmdshell`).</p> <p>### Details</p> <p>### Vulnerability Type &amp; Title **PostgreSQL `SET search_path` SQL Injection**</p> <p>### Description &amp; Root Cause The `schema` datasource config field is interpolated directly into a raw SQL statement without proper escaping. Double quotes inside the schema name are not escaped, allowing an attacker to break out of the string literal and inject arbitrary SQL.</p> <p>**Vulnerable Code:** **File:** `packages/server/src/integrations/postgres.ts`, lines 355–358</p> <p>```typescript const search_path = this.config.schema .split(&#34;,&#34;) .map(item =&gt; `&#34;${item.trim()}&#34;`) // NO escaping of embedded &#34; await this.client.query(`SET search_path TO ${search_path.join(&#34;,&#34;)};`) ```</p> <p>`node-postgres` sends this via the **simple query protocol**, which supports multi-statement execution with semicolons.</p> <p>### Step-by-Step Reproduction 1. Edit a PostgreSQL datasource configuration. 2. Set the schema field to: `public&#34;; CREATE TABLE pwned…</p> https://cve.radiocsirt.org/vuln/ghsa-qqf5-x7mj-v43p https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2000 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Budibase ausnutzen, um eine SQL Injection durchzuführen oder beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Budibase ausnutzen, um eine SQL Injection durchzuführen oder beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2000