Search for packages
| purl | pkg:npm/budibase@0.0.23 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.5 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-rvhr-26g4-p2r8
Aliases: CVE-2026-27702 |
Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud) ## Summary A critical unsafe `eval()` … | There are no reported fixed by versions. |
|
GHSA-6964-pp88-6wp9
Aliases: CVE-2026-48128 |
Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step ### Summary The executeQuery automation step in Budibase accepts a … | There are no reported fixed by versions. |
|
GHSA-xh5j-727m-w6gg
Aliases: CVE-2026-45061 |
Budibase vulnerable to SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`) ## 1. Summary | Field | … | There are no reported fixed by versions. |
|
GHSA-82rc-gxrg-v4gf
Aliases: CVE-2026-46426 |
Budibase: Unrestricted Upload of File with Dangerous Type ### Summary The file upload endpoint `POST /api/attachments/process` does not enforce active-content … | There are no reported fixed by versions. |
|
GHSA-3263-v5v9-xq8q
Aliases: CVE-2026-45718 |
Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows ## Summary The row action … | There are no reported fixed by versions. |
|
GHSA-4647-wpjq-hh7f
Aliases: CVE-2026-33226 |
Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview ### Summary The REST datasource query preview endpoint (`POST … | There are no reported fixed by versions. |
|
GHSA-qqf5-x7mj-v43p
|
budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL ### Summary This advisory covers three distinct SQL Injection … | There are no reported fixed by versions. |
|
CVE-2026-45061
Aliases: GHSA-xh5j-727m-w6gg |
Budibase vulnerable to SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`) | Field | Value | |-------|-------| … | There are no reported fixed by versions. |