PT-2026-30171 · Budibase · Budibase

·

CVE-2026-25044

·

Published

2026-04-03

·

Updated

2026-07-24

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.33.4
Description The bash automation step executes user-provided commands using the execSync() function without proper sanitization or validation. User input is processed through the processStringSync() function, which allows template interpolation. This flaw enables an attacker with permissions to create or modify automations to inject malicious shell commands, potentially leading to remote code execution, complete system compromise, data exfiltration, and lateral movement within the infrastructure.
Recommendations Update to version 3.33.4. As a temporary workaround, disable the bash automation step in production. Implement a whitelist of allowed commands. Use parameterized command execution with proper escaping. Implement command argument validation. Use a restricted shell or command sandboxing. Add rate limiting and monitoring for command execution.

Exploit

Fix

RCE

OS Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-25044
GHSA-GJW9-34GF-RP6M

Affected Products

Budibase