CVE-2026-27702 - Vulnerability Analysis

Overview

Budibase < 3.30.4 contains a server-side code execution vulnerability caused by unsafe eval() in view filtering implementation, letting authenticated users execute arbitrary JavaScript on Budibase Cloud servers, exploit requires authentication.

Severity & Score

Impact

Authenticated users can execute arbitrary code on the server, access secrets, and read sensitive tenant data, leading to full database compromise.

Mitigation

Update to version 3.30.4 or later.

References

• https://github.com/Budibase/budibase/commit/348659810cf930dda5f669e782706594c547115d
• https://github.com/Budibase/budibase/pull/18087
• https://github.com/Budibase/budibase/releases/tag/3.30.4
• https://github.com/Budibase/budibase/security/advisories/GHSA-rvhr-26g4-p2r8

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 25, 2026

🔴 CVE-2026-27702 - Critical (9.9) Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe `eval()` vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier acco... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27702/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner