Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@budibase/server

41 known vulnerabilities (7 critical, 26 high, 8 medium), with the versions each affects and the releases that fix them.

Latest release
3.38.1 (May 12, 2026): affected by 32 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
41 · 7 critical, 26 high, 8 medium
Weekly downloads
44.7K
Dependents
0
Releases
500+ since 0.0.0 (Nov 3, 2025)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Show all 41 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 41

  • Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

    Affected: through 3.38.1.

    No fix released. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

    Affected: fixed in 3.41.3.

    No fix released. The advisory names 3.41.3 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • Budibase: SSRF via DNS rebinding in the REST datasource integration

    Affected: through 3.38.1.

    No fix released. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL

    Affected: through 3.38.1.

    No fix released. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • Budibase: Privilege escalation via public role assignment API missing app-level authorization

    Affected: through 3.38.1.

    No fix released. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • CVE-2026-73304Medium 4.9

    Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

    Affected: fixed in 3.39.25.

    No fix released. The advisory names 3.39.25 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

    Affected: through 3.38.1.

    No fix released. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • CVE-2026-73302Critical 9.0

    Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

    Affected: through 3.38.1.

    No fix released. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST

    Affected: through 3.38.1.

    No fix released. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF

    Affected: through 3.38.1.

    No fix released. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter

    Affected: through 3.38.1.

    No fix released. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • Budibase before 3.40.0 NoSQL Injection via MongoDB datasource

    Affected: through 3.38.1.

    No fix released. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • CVE-2026-73409Medium 5.1

    Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile

    Affected: through 3.38.1.

    No fix released. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • CVE-2026-73407Critical 9.0

    Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152))

    Affected: through 3.38.1.

    No fix released. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

    Affected: through 3.38.1.

    No fix released. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

Show all 41 advisoriesShow fewer advisories
  • CVE-2026-73308Medium 5.7

    Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

    Affected: through 3.38.1.

    No fix released. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • CVE-2026-73307Medium 4.9

    Budibase: SSRF via bare fetch() in uploadUrl during AI table generation

    Affected: through 3.38.1.

    No fix released. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • CVE-2026-73306Medium 5.3

    Budibase: Account Enumeration via Login Lockout Response Differential

    Affected: through 3.38.1.

    No fix released. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)

    Affected: through 3.38.1.

    No fix released. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • CVE-2026-73301Medium 4.3

    Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

    Affected: through 3.38.1.

    No fix released. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • CVE-2026-73300Critical 9.6

    Budibase: SQL Injection via `multipleStatements: true`

    Affected: through 3.38.1.

    No fix released. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override

    Affected: fixed in 3.39.9.

    No fix released. The advisory names 3.39.9 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • CVE-2026-54350Critical 10.0

    Budibase: Anonymous NoSQL operator injection via published-app query templates

    Affected: fixed in 3.39.12.

    No fix released. The advisory names 3.39.12 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored…

    Affected: fixed in 3.39.0.

    No fix released. The advisory names 3.39.0 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials

    Affected: fixed in 3.39.2.

    No fix released. The advisory names 3.39.2 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibase

    Affected: fixed in 3.39.0.

    No fix released. The advisory names 3.39.0 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • CVE-2026-54352Critical 9.6

    Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload

    Affected: fixed in 3.39.9.

    No fix released. The advisory names 3.39.9 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • CVE-2026-48148Medium 5.3

    Budibase: Unvalidated VectorDB Host Parameter Enables SSRF

    Affected: fixed in 3.35.3.

    Fixed in 3.35.3 (released Apr 8, 2026, 49 days before disclosure).

    The latest release, 3.38.1, is not affected.

    97% of @budibase/server downloads last week were affected versions (8.7K).

  • Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation

    Affected: fixed in 3.34.8.

    Fixed in 3.34.8 (released Mar 25, 2026, 63 days before disclosure).

    The latest release, 3.38.1, is not affected.

    97% of @budibase/server downloads last week were affected versions (8.7K).

  • Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration

    Affected: fixed in 3.38.1.

    Fixed in 3.38.1 (released May 12, 2026, 15 days before disclosure).

    The latest release, 3.38.1, is not affected.

    99% of @budibase/server downloads last week were affected versions (8.8K).

  • Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any…

    Affected: fixed in 3.38.1.

    Fixed in 3.38.1 (released May 12, 2026, 15 days before disclosure).

    The latest release, 3.38.1, is not affected.

    99% of @budibase/server downloads last week were affected versions (8.8K).

  • CVE-2026-45719Medium 6.5

    Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API

    Affected: fixed in 3.38.1.

    Fixed in 3.38.1 (released May 12, 2026, 15 days before disclosure).

    The latest release, 3.38.1, is not affected.

    99% of @budibase/server downloads last week were affected versions (8.8K).

  • Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection

    Affected: fixed in 3.39.0.

    No fix released. The advisory names 3.39.0 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • CVE-2026-48150Critical 9.0

    Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign

    Affected: fixed in 3.39.0.

    No fix released. The advisory names 3.39.0 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema

    Affected: fixed in 3.39.0.

    No fix released. The advisory names 3.39.0 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL

    Affected: fixed in 3.39.0.

    No fix released. The advisory names 3.39.0 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata

    Affected: fixed in 3.39.0.

    No fix released. The advisory names 3.39.0 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected.

    100% of @budibase/server downloads last week were affected versions (8.9K).

  • CVE-2026-35216Critical 9.1

    Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step

    Affected: fixed in 3.33.4.

    Fixed in 3.33.4 (released Mar 13, 2026, 21 days before disclosure).

    The latest release, 3.38.1, is not affected.

    96% of @budibase/server downloads last week were affected versions (8.6K).

  • Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write

    Affected: fixed in 3.33.4.

    Fixed in 3.33.4 (released Mar 13, 2026, 21 days before disclosure).

    The latest release, 3.38.1, is not affected.

    96% of @budibase/server downloads last week were affected versions (8.6K).

  • Budibase: Command Injection in Bash Automation Step

    Affected: fixed in 3.33.4.

    Fixed in 3.33.4 (released Mar 13, 2026, 21 days before disclosure).

    The latest release, 3.38.1, is not affected.

    96% of @budibase/server downloads last week were affected versions (8.6K).

  • Budibase has a Command Injection in PostgreSQL Dump Command

    Affected: fixed in 3.23.32.

    Fixed in 3.23.32 (released Nov 28, 2025, 101 days before disclosure).

    The latest release, 3.38.1, is not affected.

    91% of @budibase/server downloads last week were affected versions (8.2K).