PT-2026-30171 · Budibase · Budibase
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Budibase versions prior to 3.33.4
Description
The bash automation step executes user-provided commands using the
execSync() function without proper sanitization or validation. User input is processed through the processStringSync() function, which allows template interpolation. This flaw enables an attacker with permissions to create or modify automations to inject malicious shell commands, potentially leading to remote code execution, complete system compromise, data exfiltration, and lateral movement within the infrastructure.Recommendations
Update to version 3.33.4.
As a temporary workaround, disable the bash automation step in production.
Implement a whitelist of allowed commands.
Use parameterized command execution with proper escaping.
Implement command argument validation.
Use a restricted shell or command sandboxing.
Add rate limiting and monitoring for command execution.
Exploit
Fix
RCE
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Budibase