Budibase Remote Code Execution Vulnerability: Early Warning
- Severity
- CRITICAL
- CVSS
- 9.1
- Affected component
- budibase (npm)
- Affected versions
- < 3.38.1 or <= 3.30.6 or < 3.39.0 or < 3.38.2 or < 3.39.19 or < 3.30.4 or < 3.35.10
- Patched version
- 3.41.3
An early warning has been issued for a critical remote code execution vulnerability in Budibase versions before 3.41.3. This vulnerability allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball.
What happened
Budibase versions before 3.41.3 reportedly contain a remote code execution vulnerability in plugin handling. This vulnerability allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers to exfiltrate environment variables and credentials with root privileges in default deployments. This issue is under investigation and has not yet been exploited in the wild.
The affected versions of Budibase include those before 3.38.1, <= 3.30.6, < 3.39.0, < 3.38.2, < 3.39.19, < 3.30.4, and < 3.35.10. The vulnerability has been patched in version 3.41.3. Users are advised to upgrade to this version or later and review any potentially compromised environments for unauthorized access.
What to do about it
- Upgrade to Budibase version 3.41.3 or later.
- Review any potentially compromised environments for unauthorized access.
- Ensure that all plugins are from trusted sources.
- Monitor the primary sources for updates on this vulnerability.
How 0Day would have caught this
budibase is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using Budibase versions before 3.38.1, <= 3.30.6, < 3.39.0, < 3.38.2, < 3.39.19, < 3.30.4, or < 3.35.10.
What should I do right now?
Upgrade to Budibase version 3.41.3 or later and review any potentially compromised environments for unauthorized access.
Is there an official fix available?
Yes, the vulnerability has been patched in Budibase version 3.41.3.
How can I ensure my plugins are secure?
Ensure that all plugins are from trusted sources and monitor for any suspicious activity.