CVE-2026-73408
HIGH
7,6
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: high
User Interaction: required
Scope: changed
Confidentiality: high
Integrity: high
Availability: high
Description
AI Translation Available
Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait for a Budibase administrator to run schema discovery, causing the second statement to execute. The fix applies quoteMySqlIdentifier before constructing the query. This issue is fixed in version 3.39.18.
89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
StableCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Availability
Authentication
Access Control
Potential Impacts:
Execute Unauthorized Code Or Commands
Read Application Data
Gain Privileges Or Assume Identity
Bypass Protection Mechanism
Modify Application Data
Applicable Platforms
Languages:
Not Language-Specific, SQL
Technologies:
Database Server
https://github.com/Budibase/budibase/commit/d232bd92144c768884ff8c48cb2e28673d9…
https://github.com/Budibase/budibase/pull/18989
https://github.com/Budibase/budibase/releases/tag/3.39.18
https://github.com/Budibase/budibase/security/advisories/GHSA-2xgg-r2wc-c5r2