https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 08:13:47 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352819 EUVD-2026-352819 https://cve.radiocsirt.org/vuln/euvd-2026-352819 https://cve.radiocsirt.org/vuln/fkie_cve-2026-73408 <p>Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait for a Budibase administrator to run schema discovery, causing the second statement to execute. The fix applies quoteMySqlIdentifier before constructing the query. This issue is fixed in version 3.39.18.</p> <p>Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait for a Budibase administrator to run schema discovery, causing the second statement to execute. The fix applies quoteMySqlIdentifier before constructing the query. This issue is fixed in version 3.39.18.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-73408 https://cve.radiocsirt.org/vuln/ghsa-2xgg-r2wc-c5r2 <p><strong>Affected:</strong> npm: @budibase/server</p> <p>### Summary **This is a related but independently fixable vulnerability to GHSA-qqf5-x7mj-v43p (PostgreSQL SQL injection), reported in the same original disclosure and split per GitHub CNA guidance (rule 4.2.11) since it affects a separate integration, has a distinct attack precondition, and requires a separate patch.**</p> <p>The MySQL integration enables `multipleStatements: true` on the connection, permitting semicolon-separated multi-statement execution. During table introspection, table names retrieved from `INFORMATION_SCHEMA.TABLES` are interpolated into a `DESCRIBE` query wrapped in backticks, but embedded backticks in the table name are never escaped — allowing a malicious table name to break out and inject a second, attacker-controlled statement.</p> <p>### Details</p> <p>**Vulnerable Code:** File: `packages/server/src/integrations/mysql.ts`, lines 172, 305</p> <p>```typescript this.config = { ...config, multipleStatements: true, ... } // line 172 ... { sql: `DESCRIBE \`${tableName}\`;` } // line 305 — backtick NOT escaped ```</p> <p>Because `multipleStatements` is enabled, any statement appended after the backtick break-out executes as a second query in the same round trip.</p> <p>### Step-by-Step Reproduction 1. An attacker with the ability to create tables in the target MySQL database (e.g. a lower-privileged database user, or a malicious actor in a multi-tenant database) creates a table named: ``foo`; DROP TABLE users; --`` 2. In Budibase, an administrator triggers schema introspection…</p> <p><strong>Affected:</strong> npm: @budibase/server</p> <p>### Summary **This is a related but independently fixable vulnerability to GHSA-qqf5-x7mj-v43p (PostgreSQL SQL injection), reported in the same original disclosure and split per GitHub CNA guidance (rule 4.2.11) since it affects a separate integration, has a distinct attack precondition, and requires a separate patch.**</p> <p>The MySQL integration enables `multipleStatements: true` on the connection, permitting semicolon-separated multi-statement execution. During table introspection, table names retrieved from `INFORMATION_SCHEMA.TABLES` are interpolated into a `DESCRIBE` query wrapped in backticks, but embedded backticks in the table name are never escaped — allowing a malicious table name to break out and inject a second, attacker-controlled statement.</p> <p>### Details</p> <p>**Vulnerable Code:** File: `packages/server/src/integrations/mysql.ts`, lines 172, 305</p> <p>```typescript this.config = { ...config, multipleStatements: true, ... } // line 172 ... { sql: `DESCRIBE \`${tableName}\`;` } // line 305 — backtick NOT escaped ```</p> <p>Because `multipleStatements` is enabled, any statement appended after the backtick break-out executes as a second query in the same round trip.</p> <p>### Step-by-Step Reproduction 1. An attacker with the ability to create tables in the target MySQL database (e.g. a lower-privileged database user, or a malicious actor in a multi-tenant database) creates a table named: ``foo`; DROP TABLE users; --`` 2. In Budibase, an administrator triggers schema introspection…</p> https://cve.radiocsirt.org/vuln/ghsa-2xgg-r2wc-c5r2