# budibase (npm) vulnerabilities 7 known vulnerabilities (1 critical, 4 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.0.31 (Apr 2, 2020): affected by 7 advisories - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 258 - Dependents: 0 - Releases: 23 since 0.0.3 (Oct 10, 2019) - Registry: https://www.npmjs.com/package/budibase - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-64657: 0.0.3 to 0.0.31 (through the newest release) - CVE-2026-45718: 0.0.3 to 0.0.31 (through the newest release) - CVE-2026-46426: 0.0.3 to 0.0.31 (through the newest release) - CVE-2026-48128: 0.0.3 to 0.0.31 (through the newest release) - CVE-2026-45061: 0.0.3 to 0.0.31 (through the newest release) - CVE-2026-33226: 0.0.3 to 0.0.31 (through the newest release) - CVE-2026-27702: 0.0.3 to 0.0.31 (through the newest release) ## Advisories (7) ### [CVE-2026-64657](https://cve.now/CVE-2026-64657): Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL - Severity: High 8.4 - Published: Aug 17, 2026 - Affected: fixed in 3.39.19. - No fix released. The advisory names 3.39.19 as the fix, which the registry doesn't have yet. The latest release, 0.0.31, is still affected. - 100% of budibase downloads last week were affected versions (75). ### [CVE-2026-45718](https://cve.now/CVE-2026-45718): Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows - Severity: Medium 5.4 - Published: May 27, 2026 - Affected: fixed in 3.38.1. - No fix released. The advisory names 3.38.1 as the fix, which the registry doesn't have yet. The latest release, 0.0.31, is still affected. - 100% of budibase downloads last week were affected versions (75). ### [CVE-2026-46426](https://cve.now/CVE-2026-46426): Budibase: Unrestricted Upload of File with Dangerous Type - Severity: High 7.6 - Published: May 27, 2026 - Affected: fixed in 3.38.2. - No fix released. The advisory names 3.38.2 as the fix, which the registry doesn't have yet. The latest release, 0.0.31, is still affected. - 100% of budibase downloads last week were affected versions (75). ### [CVE-2026-48128](https://cve.now/CVE-2026-48128): Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step - Severity: Medium 5.1 - Published: May 27, 2026 - Affected: fixed in 3.39.0. - No fix released. The advisory names 3.39.0 as the fix, which the registry doesn't have yet. The latest release, 0.0.31, is still affected. - 100% of budibase downloads last week were affected versions (75). ### [CVE-2026-45061](https://cve.now/CVE-2026-45061): Budibase: SSRF via trivial \`.tar.gz\` substring bypass in Plugin URL upload (\`/api/plugin\`) - Severity: High 7.7 - Published: May 27, 2026 - Affected: fixed in 3.35.10. - No fix released. The advisory names 3.35.10 as the fix, which the registry doesn't have yet. The latest release, 0.0.31, is still affected. - 100% of budibase downloads last week were affected versions (75). ### [CVE-2026-33226](https://cve.now/CVE-2026-33226): Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview - Severity: High 8.7 - Published: Mar 20, 2026 - Affected: through 3.30.6. - No fix released. The latest release, 0.0.31, is still affected. - 100% of budibase downloads last week were affected versions (75). ### [CVE-2026-27702](https://cve.now/CVE-2026-27702): Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud) - Severity: Critical 9.9 - Published: Feb 25, 2026 - Affected: fixed in 3.30.4. - No fix released. The advisory names 3.30.4 as the fix, which the registry doesn't have yet. The latest release, 0.0.31, is still affected. - 100% of budibase downloads last week were affected versions (75). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/budibase Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.