CVE-2026-27702 - Vulnerability Analysis

Overview

Budibase < 3.30.4 contains a server-side code execution vulnerability caused by unsafe eval() in view filtering implementation, letting authenticated users execute arbitrary JavaScript on Budibase Cloud servers, exploit requires authentication.

Severity & Score

Impact

Authenticated users can execute arbitrary code on the server, access secrets, and read sensitive tenant data, leading to full database compromise.

Mitigation

Update to version 3.30.4 or later.

References

• https://github.com/Budibase/budibase/security/advisories/GHSA-rvhr-26g4-p2r8
• https://github.com/Budibase/budibase/commit/348659810cf930dda5f669e782706594c547115d
• https://github.com/Budibase/budibase/pull/18087
• https://github.com/Budibase/budibase/releases/tag/3.30.4

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner