Budibase NoSQL Injection Vulnerability: Early Warning and Mitigation Steps
- Severity
- HIGH
- Affected component
- @budibase/server (npm)
- Affected versions
- < 3.33.4 or <= 3.38.1 or < 3.39.0 or < 3.38.1 or < 3.39.0 or < 3.38.1 or < 2.20.0 or < 3.39.0 or <= 3.38.1 or < 3.39.0 or < 3.23.32 or < 3.39.12 or <= 3.38.1 or <= 3.38.1 or < 3.35.3 or < 3.33.4 or < 3.39.25 or < 3.38.1 or < 3.39.0 or <= 3.38.1 or < 3.33.4 or <= 3.38.1 or <= 3.38.1 or <= 3.38.1 or <= 3.38.1 or < 3.39.2 or <= 3.38.1 or <= 3.38.1 or <= 3.38.1 or <= 3.38.1 or <= 3.38.1 or < 3.39.0 or <= 3.38.1 or < 3.39.9 or < 3.34.8 or <= 3.38.1 or < 3.39.0 or < 3.39.9 or <= 3.38.1 or <= 3.38.1
- Patched version
- Not yet available
Budibase is reportedly affected by a NoSQL operator injection vulnerability that allows unauthenticated visitors to read and modify documents in various databases. This issue is under investigation.
What happened
An early warning has been issued for a critical vulnerability in Budibase. The vulnerability, tracked as GHSA-8QV3-P479-CJ62, allows unauthenticated visitors to perform NoSQL operator injections via published-app query templates. This can result in unauthorized reading and modification of documents in databases such as MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, and REST-with-JSON-body collections.
The vulnerability affects multiple versions of the @budibase/server npm package. The issue was first flagged on 2026-06-23T17:43:10+00:00. There is no evidence that this vulnerability has been exploited in the wild at this time.
What to do about it
- Upgrade to a version of Budibase that fixes this vulnerability.
- Ensure that non-SQL query roles are not set to PUBLIC.
- Monitor the provided sources for updates on patched versions and further mitigation steps.
- Consult the primary sources for the most current information on affected versions and fixes.
How 0Day would have caught this
@budibase/server is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using any version of @budibase/server npm package less than 3.33.4 or less than or equal to 3.38.1 or less than 3.39.0 or less than 3.38.1 or less than 3.39.0 or less than 3.38.1 or less than 2.20.0 or less than 3.39.0 or less than or equal to 3.38.1 or less than 3.39.0 or less than 3.23.32 or less than 3.39.12 or less than or equal to 3.38.1 or less than or equal to 3.38.1 or less than 3.35.3 or less than 3.33.4 or less than 3.39.25 or less than 3.38.1 or less than 3.39.0 or less than or equal to 3.38.1 or less than 3.33.4 or less than or equal to 3.38.1 or less than or equal to 3.38.1 or less than or equal to 3.38.1 or less than or equal to 3.38.1 or less than 3.39.2 or less than or equal to 3.38.1 or less than or equal to 3.38.1 or less than or equal to 3.38.1 or less than or equal to 3.38.1 or less than or equal to 3.38.1 or less than 3.39.0 or less than or equal to 3.38.1 or less than 3.39.9 or less than 3.34.8 or less than or equal to 3.38.1 or less than 3.39.0 or less than 3.39.9 or less than or equal to 3.38.1 or less than or equal to 3.38.1.
What should I do right now?
Upgrade to a version of Budibase that fixes this vulnerability and ensure that non-SQL query roles are not set to PUBLIC. Monitor the provided sources for updates on patched versions and further mitigation steps.
Is there an official fix available?
No official fix has been published yet. Monitor the sources below for updates.