# @budibase/server (npm) vulnerabilities 41 known vulnerabilities (7 critical, 26 high, 8 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 3.38.1 (May 12, 2026): affected by 32 advisories - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 44.7K - Dependents: 0 - Releases: 500+ since 0.0.0 (Nov 3, 2025) - Registry: https://www.npmjs.com/package/@budibase/server - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-54356: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-35219: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-73410: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-72859: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-73305: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-73304: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-73408: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-73302: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-72855: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-72849: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-73618: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-73617: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-73409: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-73407: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-73406: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-73308: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-73307: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-73306: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-73303: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-73301: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-73300: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-54351: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-54350: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-50137: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-50136: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-50132: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-54352: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-48148: 0.0.0 to 3.35.2 (3.35.3 is outside it) - CVE-2026-45548: 0.0.0 to 3.34.7 (3.34.8 is outside it) - CVE-2026-45715: 0.0.0 to 3.38.0 (3.38.1 is outside it) - CVE-2026-45717: 0.0.0 to 3.38.0 (3.38.1 is outside it) - CVE-2026-45719: 0.0.0 to 3.38.0 (3.38.1 is outside it) - CVE-2026-48146: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-48150: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-48151: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-48152: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-48153: 0.0.0 to 3.38.1 (through the newest release) - CVE-2026-35216: 0.0.0 to 3.33.3 (3.33.4 is outside it) - CVE-2026-35214: 0.0.0 to 3.33.3 (3.33.4 is outside it) - CVE-2026-25044: 0.0.0 to 3.33.3 (3.33.4 is outside it) - CVE-2026-25041: 0.0.0 to 3.23.31 (3.23.32 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (41) ### [CVE-2026-54356](https://cve.now/CVE-2026-54356): Budibase authenticated arbitrary S3 signed upload URL issuance via \`/api/attachments/:datasourceId/url\` - Severity: High 7.1 - Published: Aug 17, 2026 - Affected: through 3.38.1. - No fix released. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-35219](https://cve.now/CVE-2026-35219): Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist - Severity: High 7.1 - Published: Aug 17, 2026 - Affected: fixed in 3.41.3. - No fix released. The advisory names 3.41.3 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-73410](https://cve.now/CVE-2026-73410): Budibase: SSRF via DNS rebinding in the REST datasource integration - Severity: High 8.5 - Published: Aug 17, 2026 - Affected: through 3.38.1. - No fix released. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-72859](https://cve.now/CVE-2026-72859): Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL - Severity: High 8.3 - Published: Aug 14, 2026 - Affected: through 3.38.1. - No fix released. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-73305](https://cve.now/CVE-2026-73305): Budibase: Privilege escalation via public role assignment API missing app-level authorization - Severity: High 8.8 - Published: Aug 13, 2026 - Affected: through 3.38.1. - No fix released. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-73304](https://cve.now/CVE-2026-73304): Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users - Severity: Medium 4.9 - Published: Aug 13, 2026 - Affected: fixed in 3.39.25. - No fix released. The advisory names 3.39.25 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-73408](https://cve.now/CVE-2026-73408): Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector - Severity: High 7.6 - Published: Aug 13, 2026 - Affected: through 3.38.1. - No fix released. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-73302](https://cve.now/CVE-2026-73302): Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email\_verified - Severity: Critical 9.0 - Published: Aug 13, 2026 - Affected: through 3.38.1. - No fix released. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-72855](https://cve.now/CVE-2026-72855): Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST - Severity: High 8.4 - Published: Aug 13, 2026 - Affected: through 3.38.1. - No fix released. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-72849](https://cve.now/CVE-2026-72849): Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF - Severity: High 8.7 - Published: Aug 13, 2026 - Affected: through 3.38.1. - No fix released. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-73618](https://cve.now/CVE-2026-73618): Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter - Severity: High 8.7 - Published: Aug 13, 2026 - Affected: through 3.38.1. - No fix released. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-73617](https://cve.now/CVE-2026-73617): Budibase before 3.40.0 NoSQL Injection via MongoDB datasource - Severity: High 7.1 - Published: Aug 13, 2026 - Affected: through 3.38.1. - No fix released. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-73409](https://cve.now/CVE-2026-73409): Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile - Severity: Medium 5.1 - Published: Aug 12, 2026 - Affected: through 3.38.1. - No fix released. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-73407](https://cve.now/CVE-2026-73407): Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152)) - Severity: Critical 9.0 - Published: Aug 12, 2026 - Affected: through 3.38.1. - No fix released. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-73406](https://cve.now/CVE-2026-73406): Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint - Severity: High 7.5 - Published: Aug 12, 2026 - Affected: through 3.38.1. - No fix released. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-73308](https://cve.now/CVE-2026-73308): Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders - Severity: Medium 5.7 - Published: Aug 12, 2026 - Affected: through 3.38.1. - No fix released. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-73307](https://cve.now/CVE-2026-73307): Budibase: SSRF via bare fetch() in uploadUrl during AI table generation - Severity: Medium 4.9 - Published: Aug 12, 2026 - Affected: through 3.38.1. - No fix released. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-73306](https://cve.now/CVE-2026-73306): Budibase: Account Enumeration via Login Lockout Response Differential - Severity: Medium 5.3 - Published: Aug 12, 2026 - Affected: through 3.38.1. - No fix released. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-73303](https://cve.now/CVE-2026-73303): Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session) - Severity: High 8.2 - Published: Aug 12, 2026 - Affected: through 3.38.1. - No fix released. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-73301](https://cve.now/CVE-2026-73301): Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings - Severity: Medium 4.3 - Published: Aug 12, 2026 - Affected: through 3.38.1. - No fix released. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-73300](https://cve.now/CVE-2026-73300): Budibase: SQL Injection via \`multipleStatements: true\` - Severity: Critical 9.6 - Published: Aug 12, 2026 - Affected: through 3.38.1. - No fix released. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-54351](https://cve.now/CVE-2026-54351): Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override - Severity: High 8.2 - Published: Jun 26, 2026 - Affected: fixed in 3.39.9. - No fix released. The advisory names 3.39.9 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-54350](https://cve.now/CVE-2026-54350): Budibase: Anonymous NoSQL operator injection via published-app query templates - Severity: Critical 10.0 - Published: Jun 26, 2026 - Affected: fixed in 3.39.12. - No fix released. The advisory names 3.39.12 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-50137](https://cve.now/CVE-2026-50137): Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored… - Severity: High 8.2 - Published: Jun 26, 2026 - Affected: fixed in 3.39.0. - No fix released. The advisory names 3.39.0 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-50136](https://cve.now/CVE-2026-50136): Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials - Severity: High 7.4 - Published: Jun 26, 2026 - Affected: fixed in 3.39.2. - No fix released. The advisory names 3.39.2 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-50132](https://cve.now/CVE-2026-50132): Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibase - Severity: High 7.3 - Published: Jun 26, 2026 - Affected: fixed in 3.39.0. - No fix released. The advisory names 3.39.0 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-54352](https://cve.now/CVE-2026-54352): Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload - Severity: Critical 9.6 - Published: Jun 26, 2026 - Affected: fixed in 3.39.9. - No fix released. The advisory names 3.39.9 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-48148](https://cve.now/CVE-2026-48148): Budibase: Unvalidated VectorDB Host Parameter Enables SSRF - Severity: Medium 5.3 - Published: May 27, 2026 - Affected: fixed in 3.35.3. - Fixed in 3.35.3 (released Apr 8, 2026, 49 days before disclosure). - The latest release, 3.38.1, is not affected. - 97% of @budibase/server downloads last week were affected versions (8.7K). ### [CVE-2026-45548](https://cve.now/CVE-2026-45548): Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation - Severity: High 7.7 - Published: May 27, 2026 - Affected: fixed in 3.34.8. - Fixed in 3.34.8 (released Mar 25, 2026, 63 days before disclosure). - The latest release, 3.38.1, is not affected. - 97% of @budibase/server downloads last week were affected versions (8.7K). ### [CVE-2026-45715](https://cve.now/CVE-2026-45715): Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration - Severity: High 7.7 - Published: May 27, 2026 - Affected: fixed in 3.38.1. - Fixed in 3.38.1 (released May 12, 2026, 15 days before disclosure). - The latest release, 3.38.1, is not affected. - 99% of @budibase/server downloads last week were affected versions (8.8K). ### [CVE-2026-45717](https://cve.now/CVE-2026-45717): Budibase: \`PUT /api/datasources/:datasourceId\` is protected only by \`TABLE/READ\` permission instead of builder access, allowing any… - Severity: High 8.8 - Published: May 27, 2026 - Affected: fixed in 3.38.1. - Fixed in 3.38.1 (released May 12, 2026, 15 days before disclosure). - The latest release, 3.38.1, is not affected. - 99% of @budibase/server downloads last week were affected versions (8.8K). ### [CVE-2026-45719](https://cve.now/CVE-2026-45719): Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API - Severity: Medium 6.5 - Published: May 27, 2026 - Affected: fixed in 3.38.1. - Fixed in 3.38.1 (released May 12, 2026, 15 days before disclosure). - The latest release, 3.38.1, is not affected. - 99% of @budibase/server downloads last week were affected versions (8.8K). ### [CVE-2026-48146](https://cve.now/CVE-2026-48146): Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection - Severity: High 7.7 - Published: May 27, 2026 - Affected: fixed in 3.39.0. - No fix released. The advisory names 3.39.0 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-48150](https://cve.now/CVE-2026-48150): Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign - Severity: Critical 9.0 - Published: May 27, 2026 - Affected: fixed in 3.39.0. - No fix released. The advisory names 3.39.0 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-48151](https://cve.now/CVE-2026-48151): Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema - Severity: High 7.5 - Published: May 27, 2026 - Affected: fixed in 3.39.0. - No fix released. The advisory names 3.39.0 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-48152](https://cve.now/CVE-2026-48152): Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL - Severity: High 8.1 - Published: May 27, 2026 - Affected: fixed in 3.39.0. - No fix released. The advisory names 3.39.0 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-48153](https://cve.now/CVE-2026-48153): Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata - Severity: High 8.5 - Published: May 27, 2026 - Affected: fixed in 3.39.0. - No fix released. The advisory names 3.39.0 as the fix, which the registry doesn't have yet. The latest release, 3.38.1, is still affected. - 100% of @budibase/server downloads last week were affected versions (8.9K). ### [CVE-2026-35216](https://cve.now/CVE-2026-35216): Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step - Severity: Critical 9.1 - Published: Apr 3, 2026 - Affected: fixed in 3.33.4. - Fixed in 3.33.4 (released Mar 13, 2026, 21 days before disclosure). - The latest release, 3.38.1, is not affected. - 96% of @budibase/server downloads last week were affected versions (8.6K). ### [CVE-2026-35214](https://cve.now/CVE-2026-35214): Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write - Severity: High 8.7 - Published: Apr 3, 2026 - Affected: fixed in 3.33.4. - Fixed in 3.33.4 (released Mar 13, 2026, 21 days before disclosure). - The latest release, 3.38.1, is not affected. - 96% of @budibase/server downloads last week were affected versions (8.6K). ### [CVE-2026-25044](https://cve.now/CVE-2026-25044): Budibase: Command Injection in Bash Automation Step - Severity: High 8.7 - Published: Apr 3, 2026 - Affected: fixed in 3.33.4. - Fixed in 3.33.4 (released Mar 13, 2026, 21 days before disclosure). - The latest release, 3.38.1, is not affected. - 96% of @budibase/server downloads last week were affected versions (8.6K). ### [CVE-2026-25041](https://cve.now/CVE-2026-25041): Budibase has a Command Injection in PostgreSQL Dump Command - Severity: High 8.6 - Published: Mar 9, 2026 - Affected: fixed in 3.23.32. - Fixed in 3.23.32 (released Nov 28, 2025, 101 days before disclosure). - The latest release, 3.38.1, is not affected. - 91% of @budibase/server downloads last week were affected versions (8.2K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@budibase/server Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.