@budibase/server (npm)
Advisories
42
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.41.3 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install @budibase/server@3.41.3yarn
yarn add @budibase/server@3.41.3pnpm
pnpm add @budibase/server@3.41.3Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-6x9p-4r67-5gjx Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url` |
High EPSS 0.35% |
<= 3.38.1 | No fix yet |
| GHSA-5fpj-28rv-84r7 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist |
High EPSS 0.46% |
< 3.41.3 | 3.41.3 |
| GHSA-hfhx-w8p8-4hc7 Budibase: SSRF via bare fetch() in uploadUrl during AI table generation |
Medium EPSS 0.43% |
<= 3.38.1 | No fix yet |
| GHSA-v42f-v8xc-j435 Budibase: SSRF via DNS rebinding in the REST datasource integration |
High EPSS 0.28% |
<= 3.38.1 | No fix yet |
| GHSA-pmpg-2mxq-6xwr Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete |
High EPSS 0.34% |
<= 3.38.1 | No fix yet |
| GHSA-cr7p-cr3q-h5cm Budibase: Account Enumeration via Login Lockout Response Differential |
Medium EPSS 0.44% |
<= 3.38.1 | No fix yet |
| GHSA-pvcr-8mvp-w8qr Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF) |
High EPSS 0.16% |
<= 3.38.1 | No fix yet |
| GHSA-2xgg-r2wc-c5r2 Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector |
High EPSS 0.45% |
<= 3.38.1 | No fix yet |
| GHSA-qw6m-8fw2-2v64 Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution |
High EPSS 0.36% |
<= 3.38.1 | No fix yet |
| GHSA-gh4h-34gr-87r7 Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders |
Medium EPSS 0.41% |
<= 3.38.1 | No fix yet |
| GHSA-hr66-5mqr-8mpx Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint |
High EPSS 0.51% |
<= 3.38.1 | No fix yet |
| GHSA-mqhr-6j6h-74p5 Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak |
Critical EPSS 0.54% |
<= 3.38.1 | No fix yet |
| GHSA-hp6v-6jw7-gv2f Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified |
Critical EPSS 0.43% |
<= 3.38.1 | No fix yet |
| GHSA-xg5g-26x8-cvf4 Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution |
High EPSS 0.38% |
<= 3.38.1 | No fix yet |
| GHSA-xcx6-4f2g-hhgx Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs |
High EPSS 0.22% |
<= 3.38.1 | No fix yet |
| GHSA-ppr4-5f46-j9c6 Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile |
High EPSS 0.32% |
<= 3.38.1 | No fix yet |
| GHSA-q6x4-v3qx-85qw Budibase: SQL Injection via `multipleStatements: true` |
Critical EPSS 0.56% |
<= 3.38.1 | No fix yet |
| GHSA-c8vc-7pv3-g98p Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session) |
High EPSS 0.31% |
<= 3.38.1 | No fix yet |
| GHSA-fcrw-f7gg-6g9f Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users |
Medium EPSS 0.48% |
< 3.39.25 | 3.39.25 |
| GHSA-4qcj-m5wp-jmf4 Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings |
Medium EPSS 0.34% |
<= 3.38.1 | No fix yet |
| GHSA-j9fc-w3mr-x6mv Budibase: Privilege escalation via public role assignment API missing app-level authorization |
High EPSS 0.52% |
<= 3.38.1 | No fix yet |
| GHSA-8qv3-p479-cj62 Budibase has nonymous NoSQL operator injection via published-app query templates |
Critical EPSS 0.54% |
< 3.39.12 | 3.39.12 |
| GHSA-w7mq-r738-x278 Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload |
Critical EPSS 0.49% |
< 3.39.9 | 3.39.9 |
| GHSA-rgvg-3wpc-h44p Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override |
Critical EPSS 0.46% |
< 3.39.9 | 3.39.9 |
| GHSA-35c4-rvc8-frhm Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials |
Critical EPSS 0.41% |
< 3.39.0 | 3.39.0 |
| GHSA-jj36-r9w3-3pfh Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials |
Medium EPSS 0.29% |
< 3.39.2 | 3.39.2 |
| GHSA-v7j5-vc4m-723w Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF |
High EPSS 0.19% |
< 3.39.0 | 3.39.0 |
| GHSA-4q6h-8p4v-67vq Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata |
High EPSS 0.18% |
< 3.39.0 | 3.39.0 |
| GHSA-3gp5-q4jw-3v94 Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL |
High EPSS 0.26% |
< 3.39.0 | 3.39.0 |
| GHSA-qhv3-wjg8-6fx6 Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema |
High EPSS 0.22% |
< 3.39.0 | 3.39.0 |
| GHSA-6xp4-cf37-ppjh Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign |
Critical EPSS 0.29% |
< 3.39.0 | 3.39.0 |
| GHSA-cv96-5348-p5p8 Budibase: Unvalidated VectorDB Host Parameter Enables SSRF |
Medium EPSS 0.23% |
< 3.35.3 | 3.35.3 |
| GHSA-g6qx-g4pr-92v7 Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection |
High EPSS 0.22% |
< 3.39.0 | 3.39.0 |
| GHSA-363w-hvwh-w7m6 Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API |
Medium EPSS 0.26% |
< 3.38.1 | 3.38.1 |
| GHSA-44m2-crh7-f4q2 Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL |
High EPSS 0.25% |
< 3.38.1 | 3.38.1 |
| GHSA-fgqv-jh4g-pvg2 Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration |
High EPSS 0.26% |
< 3.38.1 | 3.38.1 |
| GHSA-rpj4-7x2v-wjrf Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation |
High EPSS 0.26% |
< 3.34.8 | 3.34.8 |
| GHSA-fcm4-4pj2-m5hf Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step |
Critical EPSS 10.90% |
< 3.33.4 | 3.33.4 |
| GHSA-2wfh-rcwf-wh23 Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write |
High EPSS 0.56% |
< 3.33.4 | 3.33.4 |
| GHSA-gjw9-34gf-rp6m Budibase: Command Injection in Bash Automation Step |
High EPSS 0.47% |
< 3.33.4 | 3.33.4 |
| GHSA-726g-59wr-cj4c @budibase/server: Command Injection in PostgreSQL Dump Command |
High EPSS 0.50% |
< 3.23.32 | 3.23.32 |
| GHSA-4g2x-vq5p-5vj6 Budibase affected by VM2 Constructor Escape Vulnerability |
Critical | < 2.20.0 | 2.20.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor