CVE-2026-48149: Budibase: Stored XSS in Text component: BASIC users execute JS in admin session via MarkdownViewer innerHTML + CDN+srcdoc CSP bypass

Synopsis

Stored cross-site scripting (XSS) in Budibase's Text component allows any BASIC app user with write access to a bound table column to inject arbitrary JavaScript into that column's content, which then executes in the browser session of anyone viewing the rendered markdown. The flaw is reachable over the network without elevated privileges, and successful exploitation gives the attacker full read and write access within the victim's active session, including admin sessions. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Budibase application over the network to submit the malicious markdown payload to the vulnerable table column.

• AuthenticationRequired

  Any low-privilege BASIC app account with WRITE permission on the bound table is sufficient to plant the payload; no admin account is needed to inject, though the payload executes in whatever session views the content.

• Victim interactionNot required

  No social-engineering or deliberate victim action is needed beyond the victim loading a page that renders the bound column in Markdown mode, which happens passively during normal application use.

• Attack complexityDetail

  The exploit is reliable and condition-free: injecting into innerHTML via marked.parse requires no race conditions, memory layout knowledge, or special environmental state.

Blast Radius

• An attacker reads all data accessible in the victim's browser session, including session tokens, cookies, and any application data visible to the logged-in user.
• An attacker performs state-changing actions on behalf of the victim, including modifying records, creating users, or changing configuration, using the victim's existing permissions.
• If the payload executes in an admin session, the attacker gains full administrative control over the Budibase instance for the duration of that session.