HarborGuard / CVE
Back to search
HIGHCVE-2026-25044Published Modified CNA GitHub_M

CVE-2026-25044: Budibase: Command Injection in Bash Automation Step

Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper sanitization or validation. User input is processed through processStringSync which allows template interpolation, potentially allowing arbitrary command execution. This issue has been patched in version 3.33.4.

Metrics

CVSS v4.0
8.7
Severity
HIGH
Fixed in
—
Affected Products
1
Affected packages
  • Budibase / budibase
    < 3.33.4
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References