Skip to main content
cve.nowby Sazabi
← npm
npmPackage

budibase

7 known vulnerabilities (1 critical, 4 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
0.0.31 (Apr 2, 2020): affected by 7 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
7 · 1 critical, 4 high, 2 medium
Weekly downloads
258
Dependents
0
Releases
23 since 0.0.3 (Oct 10, 2019)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 7

  • Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

    Affected: fixed in 3.39.19.

    No fix released. The advisory names 3.39.19 as the fix, which the registry doesn't have yet. The latest release, 0.0.31, is still affected.

    100% of budibase downloads last week were affected versions (75).

  • CVE-2026-45718Medium 5.4

    Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows

    Affected: fixed in 3.38.1.

    No fix released. The advisory names 3.38.1 as the fix, which the registry doesn't have yet. The latest release, 0.0.31, is still affected.

    100% of budibase downloads last week were affected versions (75).

  • Budibase: Unrestricted Upload of File with Dangerous Type

    Affected: fixed in 3.38.2.

    No fix released. The advisory names 3.38.2 as the fix, which the registry doesn't have yet. The latest release, 0.0.31, is still affected.

    100% of budibase downloads last week were affected versions (75).

  • CVE-2026-48128Medium 5.1

    Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step

    Affected: fixed in 3.39.0.

    No fix released. The advisory names 3.39.0 as the fix, which the registry doesn't have yet. The latest release, 0.0.31, is still affected.

    100% of budibase downloads last week were affected versions (75).

  • Budibase: SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)

    Affected: fixed in 3.35.10.

    No fix released. The advisory names 3.35.10 as the fix, which the registry doesn't have yet. The latest release, 0.0.31, is still affected.

    100% of budibase downloads last week were affected versions (75).

  • Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview

    Affected: through 3.30.6.

    No fix released. The latest release, 0.0.31, is still affected.

    100% of budibase downloads last week were affected versions (75).

  • CVE-2026-27702Critical 9.9

    Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)

    Affected: fixed in 3.30.4.

    No fix released. The advisory names 3.30.4 as the fix, which the registry doesn't have yet. The latest release, 0.0.31, is still affected.

    100% of budibase downloads last week were affected versions (75).